Research
Security News
Threat Actor Exposes Playbook for Exploiting npm to Build Blockchain-Powered Botnets
A threat actor's playbook for exploiting the npm ecosystem was exposed on the dark web, detailing how to build a blockchain-powered botnet.
The 'delegates' npm package provides a convenient way to create delegate methods and properties on objects, allowing you to forward method calls or property accesses to another object. This is particularly useful for implementing patterns like composition over inheritance, where you want to expose a certain interface on an object without inheriting from another class.
Method Delegation
This feature allows you to delegate method calls from one object to another. In the provided code, method calls to 'instance.method()' are delegated to 'obj.method()', allowing 'instance' to expose the method of 'obj'.
{
const delegates = require('delegates');
const proto = {};
const obj = { method: function() { return 'method called'; } };
delegates(proto, 'obj').method('method');
const instance = Object.create(proto);
instance.obj = obj;
console.log(instance.method()); // 'method called'
}
Property Delegation
This feature enables the delegation of property access. In the example, accessing 'instance.prop' will return the value of 'obj.prop'. This is useful for exposing properties of one object on another without direct inheritance.
{
const delegates = require('delegates');
const proto = {};
const obj = { prop: 'value' };
delegates(proto, 'obj').access('prop');
const instance = Object.create(proto);
instance.obj = obj;
console.log(instance.prop); // 'value'
}
Similar to 'delegates', 'auto-bind' helps in managing 'this' context in classes by automatically binding methods to the instance. While 'delegates' focuses on forwarding methods and properties to another object, 'auto-bind' is more about ensuring that methods in a class maintain their context.
Proxyquire is used for mocking modules in tests, which can indirectly provide functionality similar to method delegation by replacing certain methods of a module with mock functions. However, unlike 'delegates', which is used in production code for delegation, proxyquire is specifically designed for testing environments.
Node method and accessor delegation utilty.
$ npm install delegates
var delegate = require('delegates');
...
delegate(proto, 'request')
.method('acceptsLanguages')
.method('acceptsEncodings')
.method('acceptsCharsets')
.method('accepts')
.method('is')
.access('querystring')
.access('idempotent')
.access('socket')
.access('length')
.access('query')
.access('search')
.access('status')
.access('method')
.access('path')
.access('body')
.access('host')
.access('url')
.getter('subdomains')
.getter('protocol')
.getter('header')
.getter('stale')
.getter('fresh')
.getter('secure')
.getter('ips')
.getter('ip')
Creates a delegator instance used to configure using the prop
on the given
proto
object. (which is usually a prototype)
Allows the given method name
to be accessed on the host.
Creates a "getter" for the property with the given name
on the delegated
object.
Creates a "setter" for the property with the given name
on the delegated
object.
Creates an "accessor" (ie: both getter and setter) for the property with the
given name
on the delegated object.
A unique type of "accessor" that works for a "fluent" API. When called as a getter, the method returns the expected value. However, if the method is called with a value, it will return itself so it can be chained. For example:
delegate(proto, 'request')
.fluent('query')
// getter
var q = request.query();
// setter (chainable)
request
.query({ a: 1 })
.query({ b: 2 });
MIT
FAQs
delegate methods and accessors to another property
The npm package delegates receives a total of 10,349,833 weekly downloads. As such, delegates popularity was classified as popular.
We found that delegates demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A threat actor's playbook for exploiting the npm ecosystem was exposed on the dark web, detailing how to build a blockchain-powered botnet.
Security News
NVD’s backlog surpasses 20,000 CVEs as analysis slows and NIST announces new system updates to address ongoing delays.
Security News
Research
A malicious npm package disguised as a WhatsApp client is exploiting authentication flows with a remote kill switch to exfiltrate data and destroy files.