Research
Security News
Quasar RAT Disguised as an npm Package for Detecting Vulnerabilities in Ethereum Smart Contracts
Socket researchers uncover a malicious npm package posing as a tool for detecting vulnerabilities in Etherium smart contracts.
de-bowerified, de-amdified, de-gruntified... jQuery. Best used via browserify, when you don't want to include all of jQuery, just the parts you need.
Plus, it rhymes.
$ npm install --save ddd-jquery
The most basic jQuery:
var $ = require('ddd-jquery/core')
Perhaps you only want some parts?
var $ = require('ddd-jquery/core')
require('ddd-jquery/manipulation')
require('ddd-jquery/effects')
Perhaps you want a fully-armed and operational jQuery?
var $ = require('ddd-jquery');
Perhaps you want to avoid repetition?
// in your own lib/jquery.js
module.exports = require('ddd-jquery/core');
require('ddd-jquery/manipulation')
require('ddd-jquery/effects')
require('ddd-jquery/traversal')
require('ddd-jquery/deferred')
jQuery is still relatively interdependent on itself, so I recommend using their modules list for hints on what combinations of modules will actually make a difference. For example, if you do require('ddd-jquery/manipulation')
, that implicitly brings along core
, traversing
, events
, and more.
jQuery is now published on npm as a single, built file. So this is good! Sometimes, you might want only parts of jQuery without needing a separate build step. Also, tracking what was cut out of a custom jQuery build is tough a few months later when a new version of jQuery is out.
jQuery has a few components that make consuption of a modular build difficult from a CJS system like browserify:
This package has a few scripts that take a local, npm install
ed version of jQuery, and transforms it and its bower dependencies (sizzle, currently) by running them through a custom deamdify and copying them into the root of this package, which is then published to npm. It also includes the current bundled version number of jQuery as build metadata of this package (http://semver.org/ #10). For example:
0.4.0+jquery.2.1.0-beta3
... implies that this package, v0.4.0
contains jQuery 2.1.0-beta3
from npm.
The actual steps taken to transform the jQuery repo as as follows:
node_modules/jquery/src
and...core.js
to match tag version)node_modules/jquery/bower.json
into root/bower_components
. This also installs qunit and require js to allow the jQuery test suite to run (barely).bower_components/sizzle/dist/sizzle.js
to bower-dist-sizzle.js
require('./core').fn.jquery
.Pretty simple actually. To avoid conflicts, all scripts specific to this package are in _
prefixed folders. There is also an npm run clean
command that will delete everything in the repo that is not explicitly tracked by git (excluding the node_modules
folder).
This is as much a reminder to me as information for all to understand.
node _bin/prepublish.js
. Optionally run it with an argument to automatically bump ddd-jquery
's version, e.g. node _bin/prepublish.js minor
.>= PHP 5.4
, then php -S localhost:8000
will do the trick.http://localhost:8000/test?dev
and ensure that a majority of the tests pass. The current AMD-ified version of jQuery is a beta tag, so I'm assuming not all tests are currently passing. (NOTE: as of 0.4.0 this is currently broken, since the npm version of jQuery does not contain the test suite.)package.json
adequately matches jQuery changes. For example, if the previous time this package was released, the jQuery version was 2.1.0-beta1
, and now it's 2.1.0
, bump the minor version of this package. The basic idea is that if something changes in jQuery, this package's version should semantically match (not necessarily in numeric value).npm publish
MIT
FAQs
de-bowerified, de-amdified, de-gruntified... jQuery.
The npm package ddd-jquery receives a total of 8 weekly downloads. As such, ddd-jquery popularity was classified as not popular.
We found that ddd-jquery demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket researchers uncover a malicious npm package posing as a tool for detecting vulnerabilities in Etherium smart contracts.
Security News
Research
A supply chain attack on Rspack's npm packages injected cryptomining malware, potentially impacting thousands of developers.
Research
Security News
Socket researchers discovered a malware campaign on npm delivering the Skuld infostealer via typosquatted packages, exposing sensitive data.