Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Nowadays, front-end engineers need to build or compile their code before deploying or publishing. However, building/compiling is not as stable as we thought. Many factors will affect the output, such as configuration and our own code and even some dependencies. Some outputed file will be empty and even missing, so we need to check them before deploying/publishing.
It's inconvenient to check those files manually, so here comes dekko
which is a tool to test whether outputed files or directory structure is valid.
npm i --save-dev dekko
const $ = require('dekko');
$('dist')
.isDirectory()
.hasFile('lib.js')
.hasFile('lib.min.js');
pattern
and options
in parameters are the same as glob
's. If pattern
doesn't match any files with the options
, dekko will throw an error which will stop CI.
This function will return a dekko
object with the following methods.
If every item in dekko
object is a file, nothing will happen. Otherwise, dekko
will throw an error.
If every item in dekko
object is a directory, nothing will happen. Otherwise, dekko
will throw an error.
If every item in dekko
object has a sub-file with this name
, nothing will happen. Otherwise, dekko
will throw an error.
If every item in dekko
object has a sub-directory with this name
, nothing will happen. Otherwise, dekko
will throw an error.
Sometimes, built-in utility functions are not enough. Then we can use .assert
, if every item in dekko
object pass the pred
function, nothing will happen. Otherwise, dekko
will throw an error with message
.
dekko
will pass filename to pred
one by one. true
means that file is valid, and false
means invalid.
.filter
works like Array.prototype.filter
, and it return a new dekko
object with filtered items.
MIT
FAQs
To test whether files and directory structure are valid.
The npm package dekko receives a total of 17,207 weekly downloads. As such, dekko popularity was classified as popular.
We found that dekko demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.