Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
dynamic-script-loader
Advanced tools
A script loader for modular components in es6 (build process coming soon). This is built so that each components being responsible for what 3rd party dependencies they need.
then
then
npm i -S dynamic-script-loader
simple
const ScriptLoader = require('dynamic-script-loader')
const script = new ScriptLoader()
script.load({
src: '//path/to/someExternalJS.js',
async: true, // default to true, you can leave this out
}), function oneTimeSetUp () {
// window.someExternalJS setup here
})
.then(function externalJSSuccessResolver () {
// this runs after one time setup
})
.catch(function scriptDidntLoad () {
console.log(':(')
})
creating a vue wrapper for 3rd party libraries
heres a couple of ways you can use the script loader
import DynamicScriptLoader from 'dynamic-script-loader'
Vue.use({
install: function (Vue, options) {
Vue.prototype.$script = new DynamicScriptLoader()
}
})
// inside a Vue component
data () {
return {
message: '',
error: ''
}
},
mounted () {
// the loader will not load libraries if they have already been loaded
this.$script.load({
src: '//some-cdn/src/js/library.js',
async: true
}, () => {
// one time setup
some3rdPartyLib.credentials('123')
some3rdPartyLib.partyTime = true
some3rdPartyLib.breakRandomly = Math.random() % 2 === 1
})
.then(() => {
// something to run everytime this component is mounted
this.message = some3rdPartyLib.getMessage()
})
.catch(() => {
// script failed to load
this.error = 'oops'
})
}
would like to use this as
script.load('//path/to/someExternalJS.js')
.once(() => {
// one time setup
})
.then(() => {
// success! :D
})
.catch(() => {
// failure! D:
})
or instead of once
maybe setup
?
git clone git@github.com:john-ko/dynamic-script-loader.git
cd dynamic-script-loader
npm install
add changes
npm run test:unit
npm run test:e2e
FAQs
script loader for module components
We found that dynamic-script-loader demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.