Research
Security News
Threat Actor Exposes Playbook for Exploiting npm to Build Blockchain-Powered Botnets
A threat actor's playbook for exploiting the npm ecosystem was exposed on the dark web, detailing how to build a blockchain-powered botnet.
The npm package 'endent' is a utility for creating multiline strings that maintain predictable indentation. It is particularly useful when working with code generation, templating, or any scenario where managing whitespace and indentation is crucial. The package helps to ensure that multiline strings are formatted neatly without the hassle of manually managing spaces or tabs.
Indentation Management
This feature allows users to easily manage indentation within multiline strings. The example shows how to use endent to create a neatly indented function as a string.
const endent = require('endent');
const result = endent`
function example() {
console.log('Hello, world!');
}
`;
console.log(result);
Template Literals Enhancement
Enhances template literals by automatically handling indentation and interpolation. The example demonstrates creating a personalized greeting message with dynamic data insertion and proper indentation.
const endent = require('endent');
const user = 'Alice';
const greeting = endent`
Hello, ${user}!
Welcome to our service.
`;
console.log(greeting);
Similar to endent, 'dedent' also helps in managing the indentation of template literals. However, while endent focuses on maintaining and managing indentation, dedent primarily aims to remove excess indentation, making it more about normalization rather than creation.
The 'outdent' package offers functionality similar to endent by allowing users to control indentation in multiline strings. It provides a slightly different API and additional options for customization compared to endent, which might be preferable depending on specific user needs.
An ES6 string tag that makes indentation right, adds some key features to dedent.
import dedent from "dedent"
import endent from "endent"
var someobj = {
contact: {
jack: 123456,
tom: 654321
},
color: "blue"
}
var somejson = '["bear", "fish", "dog", "cat"]'
var awfulTmpl = dedent`
function store (state, emitter) {
state["someobj"] = ${JSON.stringify(someobj, null, 2)}
state["somejson"] = ${JSON.stringify(JSON.parse(somejson), null, 2)}
}
`
// use endent.pretty(value) when value is object or array.
var prettyTmpl = endent`
function store (state, emitter) {
state["someobj"] = ${endent.pretty(someobj)}
state["somejson"] = ${somejson}
}
`
console.log(awfulTmpl + "\n\n" + prettyTmpl)
// awfulTmpl
function store (state, emitter) {
state["someobj"] = {
"contact": {
"jack": 123456,
"tom": 654321
},
"color": "blue"
}
state["somejson"] = [
"bear",
"fish",
"dog"
]
}
// prettyTmpl
function store (state, emitter) {
state["someobj"] = {
"contact": {
"jack": 123456,
"tom": 654321
},
"color": "blue"
}
state["somejson"] = [
"bear",
"fish",
"dog",
"cat"
]
}
var dependencies = ['jquery', 'underscore', 'bootstrap']
var dependencyTmpl = ``
dependencies.forEach((d, i) => {
dependencyTmpl += `var ${d} = require("${d}")\n`
})
var awfulTmpl = dedent`
;(function () {
${dependencyTmpl}
})()
`
var prettyTmpl = endent`
;(function () {
${dependencyTmpl}
})()
`
console.log(awfulTmpl + "\n\n" + prettyTmpl)
// awfulTmpl
;(function () {
var jquery = require('jquery')
var underscore = require('underscore')
var bootstrap = require('bootstrap')
})()
// prettyTmpl
;(function () {
var jquery = require('jquery')
var underscore = require('underscore')
var bootstrap = require('bootstrap')
})()
MIT
FAQs
➡️ An ES6 string tag that makes indentation right
The npm package endent receives a total of 3,040,449 weekly downloads. As such, endent popularity was classified as popular.
We found that endent demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A threat actor's playbook for exploiting the npm ecosystem was exposed on the dark web, detailing how to build a blockchain-powered botnet.
Security News
NVD’s backlog surpasses 20,000 CVEs as analysis slows and NIST announces new system updates to address ongoing delays.
Security News
Research
A malicious npm package disguised as a WhatsApp client is exploiting authentication flows with a remote kill switch to exfiltrate data and destroy files.