Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
enable-browser-mode
Advanced tools
Simulate the browser with ease by setting the global object to a JSDOM window and painlessly run browser JS without errors.
The goal of this package is to work as a quick-and-dirty one-liner that will allow a Node process to imitate a browser, letting you import traditional browser JS by setting the global object to window
and binding relevant native prototype methods like window.Event
.
/* [CommonJS] */
require('enable-browser-mode');
- or -
/* [ES6] */
import 'enable-browser-mode'
No variable assignment required, just call it! You can then require browser JS with:
/* Node */
include('./jquery.min.js');
- or -
/* [CLI] */
$ enable-browser-mode test/jquery.js test/jquery2.js
Which will evaluate that script in the global context. Make sure the scripts supplied to window.include()
are trusted.
Won't work:
console.log(document.createElement('a'));
// ReferenceError: document is not defined
Works like a charm:
require('enable-browser-mode');
console.log(document.createElement('a'));
// HTMLAnchorElement {Symbol(impl): HTMLAnchorElementImpl}
By importing this package (which depends on JSDOM), we can expose the necessary globals and bind window
as the global object, meaning we can write all of our browser-optimized (and DOM-dependent) code in a file like browser.js
and reuse that same code in Node with include('browser.js')
or window.include('browser.js')
.
The specific need for this functionality came from the web-widgets
package, which generates widget trees using DOM operations like document.createElement()
. The Node runtime cannot build out this widget tree by default, as it does not have access to the window
and document
variables, resulting in a ReferenceError
.
For server-side rendering in Node, web-widgets
builds out the widget tree on the virtual DOM and then exports it as flat HTML using the HTMLElement.outerHTML
property; in the browser, the DOM is manipulated directly on-the-fly (i.e. with HTMLElement.appendChild
). By simulating the browser global, we can use the exact same core library for both cases, the difference being just Widget.render(HTMLElement)
to render into a DOM element and Widget.export()
to dump the outerHTML.
Using enable-browser-mode
, all that is needed to reuse original browser libraries (including jQuery, HammerJS, etc.) is creating an separate JS file for your Node logic, importing this package, and then importing your browser code with include
:
require('enable-browser-mode');
window.include('browser.js');
myBrowserObject.doBrowserStuff();
// code like you're in the browser =)
By default, JSDOM is called with runScripts: 'outside-only'
. If you need to execute external JS (and not just add a <script>
element to the DOM), set global.UNSAFE_MODE
before your require('enable-browser-mode')
call.
FAQs
Simulate the browser with ease by setting the global object to a JSDOM window and painlessly run browser JS without errors.
The npm package enable-browser-mode receives a total of 2 weekly downloads. As such, enable-browser-mode popularity was classified as not popular.
We found that enable-browser-mode demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.