Research
Security News
Quasar RAT Disguised as an npm Package for Detecting Vulnerabilities in Ethereum Smart Contracts
Socket researchers uncover a malicious npm package posing as a tool for detecting vulnerabilities in Etherium smart contracts.
dependable
Advanced tools
A minimalist dependency injection framework for node.js.
Create a new container by calling dependable.container
:
var dependable = require('dependable'),
container = dependable.container();
Register a few dependencies for later use (a string and an object):
container.register('occupation', 'tax attorney');
container.register('transport', {
type: 'station wagon',
material: 'wood-paneled'
});
When the argument is a function, the function's arguments are automatically populated with the correct dependencies, and the return value of the function is registered as the dependency:
container.register('song', function (occupation, transport, legalStatus) {
var song = {};
song.chorus = function chorus() {
return [
'I\'m a ' + occupation,
'On a ' + transport.material + ' ' + transport.type + ' I ride',
'And I\'m ' + legalStatus.message
].join('\n');
};
return song;
});
song
depends on a legalStatus
, which hasn't been registered yet.
Dependable resolves dependencies lazily, so we can define this dependency
after-the-fact:
container.register('legalStatus', {
warrants: [],
message: 'without outstanding warrants'
});
Like with container.register, the function arguments are automatically resolved, along with their dependencies:
container.resolve(function (song) {
/*
* I'm a tax attorney
* On a wood-paneled station wagon I ride
* And I'm without outstanding warrants
*/
console.log(song.chorus());
});
As it stands, song
returns boring, non-catchy lyrics. One way to change its behavior
is to re-register its dependencies:
container.register('occupation', 'cowboy');
container.register('legalStatus', {
warrants: [
{
for: 'shooting the sheriff',
notes: 'did not shoot the deputy'
}
],
message: 'wanted: dead or alive'
});
This is really useful in a number of situations:
To resolve the updated dependencies, provide an empty override:
container.resolve({}, function (song) {
/*
* I'm a cowboy
* On a wood-paneled station wagon I ride
* And I'm wanted: dead or alive
*/
console.log(song.chorus());
});
It's also possible to override dependencies at resolve time:
var horse = {
type: 'horse',
material: 'steel'
};
container.resolve({ transport: horse }, function (song) {
/*
* I'm a cowboy
* On a steel horse I ride
* And I'm wanted: dead or alive
*/
console.log(song.chorus());
});
Sounds like a hit!
container.register(name, function)
- Registers a dependency by name. function
can be a function that takes dependencies and returns anything, or an object itself with no dependencies.
container.register(hash)
- Registers a hash of names and dependencies. This is useful for setting configuration constants.
container.load(fileOrFolder)
- Registers a file, using its file name as the name, or all files in a folder. Does not traverse subdirectories.
container.get(name, overrides = {})
- Returns a dependency by name, with all dependencies injected. If you specify overrides, the dependency will be given those overrides instead of those registered.
container.getSandboxed(name, overrides = {})
- Returns a dependency by name, with all dependencies injected. Unlike get
, you must specify overrides for all dependencies. This can (and should) be used during testing to ensure a module under test has been competely isolated.
container.resolve(overrides={}, cb)
- Calls cb
like a dependency function, injecting any dependencies found in the signature. Like container.get
, this supports overrides.
container.list()
- Return a list of registered dependencies.
Dependable is written in coffeescript. To generate javascript, run npm run prepublish
.
Tests are written with mocha. To run the tests, run npm test
.
FAQs
A minimalist dependency injection framework for node.js.
The npm package dependable receives a total of 1,640 weekly downloads. As such, dependable popularity was classified as popular.
We found that dependable demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket researchers uncover a malicious npm package posing as a tool for detecting vulnerabilities in Etherium smart contracts.
Security News
Research
A supply chain attack on Rspack's npm packages injected cryptomining malware, potentially impacting thousands of developers.
Research
Security News
Socket researchers discovered a malware campaign on npm delivering the Skuld infostealer via typosquatted packages, exposing sensitive data.