Research
Security News
Quasar RAT Disguised as an npm Package for Detecting Vulnerabilities in Ethereum Smart Contracts
Socket researchers uncover a malicious npm package posing as a tool for detecting vulnerabilities in Etherium smart contracts.
How often do you have code like this?
import Thing from 'my/thing';
import OtherThing from 'other/thing';
// :-/
const { assign, keys } = Object;
//....
function assignThings() {
return assign(new Thing(), new OtherThings());
}
For every other piece of code out there, it's very straight
forward. You import a name from a module, and then you use it later.
However, for builtin functions, which are really no different, you
have to either use them from a dynamically scoped global
object. e.g. Object.assign
, or destructure them as a constant
assignment from the dynamically scoped global object.
The ecma
module lets you treat all of your symbolic imports
the same, no exceptions:
import Thing from 'my/thing';
import OtherThing from 'other/thing';
import { assign, keys } from 'ecma/object';
For each JavaScript global supported, that global is the default export, then, any properties of that global are exported as named values.
So for example, the Math
global has the properties Math.PI
(the
constant), and Math.pow
(raise any number to a power). We could
define a function to compute the area of a circle like so:
import { PI, pow } from 'ecma/math';
export function area(radius) {
return PI * pow(radius, 2);
}
By the same token, you could also define it this way:
import Math from 'ecma/math';
export function area(radius) {
return Math.PI * Math.pow(radius, 2);
}
Although that wouldn't have much value over just using the global, dynamically scoped constant.
There are currently exports for:
ecma/array
ecma/number
ecma/object
ecma/string
FAQs
Statically import JavaScript builtins
The npm package ecma receives a total of 1 weekly downloads. As such, ecma popularity was classified as not popular.
We found that ecma demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket researchers uncover a malicious npm package posing as a tool for detecting vulnerabilities in Etherium smart contracts.
Security News
Research
A supply chain attack on Rspack's npm packages injected cryptomining malware, potentially impacting thousands of developers.
Research
Security News
Socket researchers discovered a malware campaign on npm delivering the Skuld infostealer via typosquatted packages, exposing sensitive data.