Research
Security News
Threat Actor Exposes Playbook for Exploiting npm to Build Blockchain-Powered Botnets
A threat actor's playbook for exploiting the npm ecosystem was exposed on the dark web, detailing how to build a blockchain-powered botnet.
[![NPM version][npm-image]][npm-url] [![build status][travis-image]][travis-url] [![Test coverage][coveralls-image]][coveralls-url] [![Gittip][gittip-image]][gittip-url]
The ideal JS development environment. Write your JS in the latest ES syntax, then serve compiled JS specific to the browser. In other words, if your code as generators, it compiles your JS to ES6 using regenerator, otherwise it just serves it.
The end goal of this project is to create a frontend flow where:
Features:
var Ecstacy = require('ecstacy')
The cache folder where all the transpiled JS, minified, and gzipped files are saved.
This build folder is global, but because code is cached based on a
sha256
sum, there should not be any conflicts.
Delete the entire cache folder.
Per-file lru
cache options. Defaults to:
max
- 100
maxAge
- Infinity
These cache useragent -> transforms
lookups per instance.
Create a new instance based on js
with an optional source map
.
Inline source maps are also supported.
Some public properties:
.code
- the JS without source maps.map
- the source map, if any.hash
- the sha256
sum of the JSTranspiles the JS and returns metadata on them.
name
- the name of the builddate
- the date this build was created for Last-Modified
headershash
- a sha256
sha sum of the JS file in hex
encoding for ETag
headerstransforms[]
- an array of all the transform names usedlength[extension]
- the byte size of each build for Content-Length
headersIf no transforms were used, then name === hash
and hash === ecstacy.hash
.
The possible extensions are:
.json
- the returns data.js
.js.gz
.js.map
.js.map.gz
.min.js
.min.js.gz
.min.js.map
.min.js.map.gz
Read a file by its data.name
and extension
.
Returns a Buffer
, so you need to .toString()
it yourself.
var ecstacy = Ecstacy(code)
ecstacy.build(useragent).then(function (data) {
return ecstacy.read(data.name, '.min.js.gz')
}).then(function (buf) {
return buf.toString()
})
You may want to serve the smallest of data.length['.min.js.gz']
and data.length['.min.js']
if you like to over-optimize.
You also probably don't need to stringify the buffer to send it to the client.
Use a custom transform in additional to the included ones.
data.length['min.js']
will be 0
.FAQs
transpile JS based on user agents
The npm package ecstacy receives a total of 1 weekly downloads. As such, ecstacy popularity was classified as not popular.
We found that ecstacy demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A threat actor's playbook for exploiting the npm ecosystem was exposed on the dark web, detailing how to build a blockchain-powered botnet.
Security News
NVD’s backlog surpasses 20,000 CVEs as analysis slows and NIST announces new system updates to address ongoing delays.
Security News
Research
A malicious npm package disguised as a WhatsApp client is exploiting authentication flows with a remote kill switch to exfiltrate data and destroy files.