Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
ember-weakmap
Advanced tools
This addon is a polyfill for the Ember.WeakMap RFC.
A WeakMap provides a mechanism for storing and retrieving private state. The WeakMap itself does not retain a reference to the state, allowing the state to be reclaimed when the key is reclaimed.
A traditional WeakMap (and the one that will be part of the ES2015 language) allows for weakness from key -> map, and also from map -> key. This allows either the Map, or the key being reclaimed to also release the state.
Unfortunately, this bi-directional weakness is problematic to polyfill. Luckily, uni-directional weakness, in either direction, "just works". A polyfill must just choose a direction.
Note: Just like ES2015 WeakMap, only non null Objects can be used as keys
ember install ember-weakmap
import Ember from 'ember';
const myWeakMap = new Ember.WeakMap();
/*
* @method set
* @param key {Object}
* @param value {Any}
* @return {Any} stored value
*/
const emailObj = { id: 1, subject: 'Hello World' };
myWeakMap.set(emailObj, {read: true});
The key must be an object.
/*
* @method get
* @param key {Object}
* @return {*} stored value
*/
myWeakMap.get(emailObj); // => { read: true }
myWeakMap.get(someObjThatWasNotSet); // => undefined
/*
* @method has
* @param key {Object}
* @return {Boolean} if the key exists
*/
myWeakMap.has(emailObj); // => true
myWeakMap.has(someObjThatWasNotSet); // => false
/*
* @method delete
* @param key {Object}
*/
myWeakMap.delete(emailObj);
myWeakMap.get(emailObj); // => undefined
myWeakMap.has(emailObj); // false
FAQs
ES2015 WeakMap polyfill for Ember.WeakMap
The npm package ember-weakmap receives a total of 6,215 weekly downloads. As such, ember-weakmap popularity was classified as popular.
We found that ember-weakmap demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.