Security News
Supply Chain Attack Detected in Solana's web3.js Library
A supply chain attack has been detected in versions 1.95.6 and 1.95.7 of the popular @solana/web3.js library.
Welcome to the future.
It was 9:22pm PDT, March 31st. I had been working diligently on a groundbreaking new framework, when suddenly, my computer monitor turned off. Strange, I thought, must be a Yosemite bug. After a few seconds, it turned back on again. All was good... or so it seemed. After writing more groundbreaking code, I went to test it. However, a warning was in my console:
WARNING: The proper ES2099 directive was not set. This code is running in quirks mode, to ensure full compatibility.
I was perplexed. What was ES2099? None of my code seemed to run either... until about 10 seconds later, when the first function I declared fired. Then, 10 seconds later, another. I knew something was wrong.
$ date
Tue 31 Mar 2099 21:26:36 PDT
That didn't seem right. Maybe a time server messed up. Then, I googled "ES2099", and there it was:
There it was, in all its glory. ES2099. I knew what I had to do: download it. I quickly did so. Suddenly, Chrome crashed. My monitor turned off and on.
$ date
Tue 31 Mar 2015 21:30:21 PDT
$ ls ~/Downloads
es2099-draft.html
ES2099 truly is the future. However, since no browsers support it yet, I've created a transpiler.
$ npm install es2099 -g
$ es2099 in.js > out.js
Unfortunately, I soon found out my copy of the ES2099 spec was corrupted. It only downloaded part of it. So, I can only implement what I know, plus what's feasible with current day browsers. (I tried very hard to implement StreamingPromiseGenerator
, but to no avail) Here's what I have implemented:
Over the years, there were way too many arguments about JS formatting. It seems that ES2099 fixed this, by defining the ES2099 Standard Style. If you wish to have your code be ES2099 ready, it must be written in this style. No arguments. It's the way of the future.
As JS evolved, many browser vendors introduced their own directives to ensure their browser had the best performance. However, there were just too many directives. So, ES2099 created a standardized directive, like a DOCTYPE. It was carefully crafted to ensure backwards compatibility. To enable ES2099, include this directive as your first line:
'use stricter+strictest-superstrict+es2099ready'
In particular, this enables stricter
, strictest
, and es2099ready
. It disables superstrict
, as this directive was found to cause too many problems. This must be the first line exactly, otherwise your JS will run in quirks mode. Quirks mode will only run one function every 10 seconds, to ensure compatibility with old slow browsers.
All JS must now have a main
function for browsers to call, so they don't have to guess about what function to call first. This is an amazing performance enhancement. Define it in the root of your file, as so:
function main () {
// your super fast code here
}
The ES2099 spec mentioned that there are talks to make it asynchronous in future specs, but major discussion was still under place.
Another performance improvement, ES2099 requires all variables are constants. This allows browsers to optimize variables, as they will never be changed.
var foo = 'bar' // nope
let baz = 'bat' // ew!
const future = true // nice
Many people never understood why null
had the type of an object
. It turns out the spec writers didn't either, and instead turned it into a string
. This greatly improves performances, due to string
s requiring less memory than an object.
typeof null
// 'string'
Promises were revolutionary in ES2015. However, learning from "The Great Languages" (there was no context for this), they were instead renamed Monad
. They have the same API, they're just Monads.
var p = new Promise() // ah ah ah!
var m = new Monad() // groovy
ES2099 is compatible with every version before it (except ES2074... there's just a note not to talk about it). Because of this, all scripts are run through babel
to create ES5 output. As well, if there are any ES2099 errors, your code will be run in Quirks mode.
Here's the thing: I can't be the only one that this will ever happen to. So, if you happen to travel into the future and get a copy of ES2099, please feel free to send a PR to improve what we know of ES2099. Of course, by the time you see it, it may be changed because of what I have done.
... Oh no, what have I done.
FAQs
Literally the future of JS
We found that es2099 demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
A supply chain attack has been detected in versions 1.95.6 and 1.95.7 of the popular @solana/web3.js library.
Research
Security News
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
Security News
Research
Socket researchers have discovered malicious npm packages targeting crypto developers, stealing credentials and wallet data using spyware delivered through typosquats of popular cryptographic libraries.