
Security News
vlt Launches "reproduce": A New Tool Challenging the Limits of Package Provenance
vlt's new "reproduce" tool verifies npm packages against their source code, outperforming traditional provenance adoption in the JavaScript ecosystem.
A javascript self-interpreter with a focus on sandboxed execution and runtime introspection.
At the most basic level, esper's eval function can be used as a safe replacement for the native eval function.
var four = esper.eval('2+2');
More functionality is available via an Engine object.
var engine = esper({
});
engine.addGlobal('two', 2);
engine.load('2+two');
var result = engine.runSync();
result.toNative() === 4;
The esper()
function takes an options object as it only parameter.
strict
Type: boolean
Default: false
If true, force all code to be run in strict mode.
foreignObjectMode
Type: string
Default: link
addInternalStack
Type: boolean
Default: false
If true, the interpreter's internal stack will be added to the stack trace of exceptions.
executionLimit
Type: Integer
Default: Infinity
The number of AST nodes methods like .runSync()
will evaluate before giving up. Set this
to prevent infinite loops.
exposeEsperGlobal
Type: boolean
Default: true
Creates a global named Esper
inside the interpreter with introspection and metaprogramming functions.
Esper utilizes the webpack build system to create a single file suitable for use in the browser.
--profile=<profile>
Profile | Use |
---|---|
web | The default profile. Creates an single ES5 compatible file with self contained regenerator-runtime and es6 polyfills. |
modern | Creates an single ES6 compatible file. More performance than web, but requires a modern browser. |
nashorn | Crates a single file targeting the Java Nashorn engine. Uses Nashorn's parser instead of embedded esprima. |
--test
Creates a test builds that embeds the unit tests. Including this file in a <script>
tag will take over the page and
display the test output in real time.
--min
Minify the resulting build using UglifyJS.
If you'd like to contribute, please sign the CodeCombat contributor license agreement so we can accept your pull requests.
Checklist for contributing:
npm run test
npm run style
npm run cover
webpack --test
build passes test in browser.FAQs
Esper javascript interperter.
The npm package esper.js receives a total of 15 weekly downloads. As such, esper.js popularity was classified as not popular.
We found that esper.js demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
vlt's new "reproduce" tool verifies npm packages against their source code, outperforming traditional provenance adoption in the JavaScript ecosystem.
Research
Security News
Socket researchers uncovered a malicious PyPI package exploiting Deezer’s API to enable coordinated music piracy through API abuse and C2 server control.
Research
The Socket Research Team discovered a malicious npm package, '@ton-wallet/create', stealing cryptocurrency wallet keys from developers and users in the TON ecosystem.