Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
The 'delay' npm package is a simple utility that allows you to pause the execution of an asynchronous function for a specified amount of time. It is primarily used to introduce delays in promise chains or async functions, making it useful for testing, rate limiting, or creating time-based behavior in applications.
Basic Delay
This feature allows you to pause the execution of code within an async function for a specified duration (in milliseconds). In this example, the code waits for 2 seconds before printing '2 seconds later'.
const delay = require('delay');
(async () => {
console.log('Waiting...');
await delay(2000);
console.log('2 seconds later');
})();
Delay with Value
This feature enables you to resolve a promise with a specific value after a delay. Here, the promise resolves with the string 'Hello after 1.5 seconds' after waiting for 1.5 seconds.
const delay = require('delay');
(async () => {
const result = await delay(1500, {value: 'Hello after 1.5 seconds'});
console.log(result);
})();
Delay with Options
This feature supports passing an options object that can include an AbortSignal to cancel the delay. If the abort signal is triggered, the delay is cancelled, and the subsequent code may not execute.
const delay = require('delay');
(async () => {
await delay(1000, {signal: someAbortSignal});
console.log('This will not run if the abort signal is triggered');
})();
Similar to 'delay', 'timeout' is used to introduce a delay in asynchronous operations. However, it focuses more on setting timeouts for promises, potentially rejecting them if they take too long, which is a slight functional shift from simply delaying.
This package offers functionality similar to 'delay' by resolving a promise after a specified timeout. The main difference is in the API design and naming conventions, but the core functionality of introducing delays in promise-based workflows is very similar.
While 'p-timeout' provides delay functionalities, it is primarily designed to add timeout capabilities to promises. It can reject a promise if it does not settle within a specified period, which is a feature not provided by 'delay'.
Delay a promise a specified amount of time
$ npm install --save delay
const delay = require('delay');
delay(200)
.then(() => {
// executed after 200 milliseconds
});
somePromise()
.then(delay(100))
.then(result => {
// executed 100 milliseconds after somePromise resolves
// the result from somePromise is passed through
});
// and with Babel and async functions
async () => {
bar();
await delay(100);
// executed 100 milliseconds later
baz();
}();
// there's also delay.reject() that takes the value, and rejects it `ms` later
Promise.resolve('foo')
.then(delay.reject(100))
.then(x => blah()) // never executed
.catch(err => {
// executed 100 milliseconds later
// err === 'foo'
});
// you can also specify the rejection value
Promise.resolve('foo')
.then(delay.reject(100, 'bar'))
.then(x => blah()) // never executed
.catch(err => {
// executed 100 milliseconds later
// err === 'bar'
});
setImmediate()
MIT © Sindre Sorhus
FAQs
Delay a promise a specified amount of time
The npm package delay receives a total of 3,943,218 weekly downloads. As such, delay popularity was classified as popular.
We found that delay demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.