Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Utilities you'll need when migrating to ESModule.
yarn add esm-utils
import createEsmUtils from 'esm-utils'
const {
dirname,
filename,
require,
importModule,
resolve,
readJson,
readJsonSync,
} = createEsmUtils(import.meta)
/* Those named exports only accept absolute path or URL */
import {
importModule,
readJson,
loadJson,
readJsonSync,
loadJsonSync,
} from 'esm-utils'
createEsmUtils(import.meta | URL | 'string')
Returns an object
with the following properties:
dirname
(alias __dirname
)filename
(alias __filename
)require
importModule
(alias import
)resolve
readJson
(alias loadJson
)readJsonSync
(alias loadJsonSync
)Please read this note before you use dirname
and filename
Sync version of readJson
.
utils.importModule(string | URL, options?)
Same as import()
, but accepts absolute path (on Windows, import('C:\\foo.js')
error throws when pass a absolute path starts with a drive letter).
options.traceSyntaxError
type: boolean
default: false
Due to this Node.js issue, Node.js does not emit the location of the syntax error in the error thrown in dynamic import()
.
When set traceSyntaxError: true
, we'll try to get a better error message by running node <file>
in a child process.
utils.readJson(string | URL)
Returns Promise<jsonObject>
.
utils.readJsonSync(string | URL)
Sync version of utils.readJson
utils.resolve(string | URL)
Ponyfill for import.meta.resolve
.
If import.meta.resolve
exits, use it directly, otherwise returns a simple wrapper of import-meta-resolve.
With Import Assertions
import foo from './foo.json' assert {type: 'json'}
await import('./foo.json', {assert: {type: 'json'}})
With require
, like CommonJS
import createEsmUtils from 'esm-utils'
const {require} = createEsmUtils(import.meta)
const foo = require('./foo.json')
With readJson
or readJsonSync
import createEsmUtils from 'esm-utils'
const {readJson} = createEsmUtils(import.meta)
const foo = await readJson('./foo.json')
import createEsmUtils from 'esm-utils'
const {readJsonSync} = createEsmUtils(import.meta)
const foo = readJsonSync('./foo.json')
importModule()
Same as utils.importModule()
, but only accept absolute path or URL.
readJson()
(alias loadJson
)Same as utils.readJson()
, but only accept absolute path or URL.
readJsonSync()
(alias loadJsonSync
)Same as utils.readJsonSync()
, but only accept absolute path or URL.
dirname
and filename
The dirname
and filename
supposed to be a quick solution when migrating to ES Modules. In most cases, you don't need them, because many APIs accept URL
directly.
/* BAD */
import fs from 'node:fs/promises'
import path from 'node:path'
import createEsmUtils from 'esm-utils'
const {dirname} = createEsmUtils(import.meta)
const buffer = await fs.readFile(
path.join(dirname, './path/to/file')
)
/* GOOD */
import fs from 'node:fs/promises'
const buffer = await fs.readFile(
new URL('./path/to/file', import.meta.url)
)
FAQs
Utilities you'll need when migrating to ESModule.
We found that esm-utils demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.