Research
Security News
Threat Actor Exposes Playbook for Exploiting npm to Build Blockchain-Powered Botnets
A threat actor's playbook for exploiting the npm ecosystem was exposed on the dark web, detailing how to build a blockchain-powered botnet.
Run your TypeScript files quickly and with more positivity.
esyes
transforms your JavaScript and TypeScript files using
esbuild-kit
. It works seamlessly and
requires no configuration to get the job done.
It also translates import.meta.env
features on the fly, so
you can use JavaScript or TypeScript modules written with import.meta.env
directly in Node.
Hat tip to @NullVoxPopuli for the idea, originally implemented in this PR in the Starbeam repository.
node
Commandimport.meta.env
SupportWhen using esyes
to run npm scripts, install via your package manager.
$ pnpm i -D esyes
You can also install esyes globally via your package manager.
$ pnpm i -g esyes
You can also install esyes
with volta, which allows you
to bind it to a node version.
$ volta install esyes node@20
If you install
esyes
via volta and you're using it in a project with a pinned version of Node in its package.json,esyes
will automatically use that version.
node
Command$ cat hi.ts
const hello = "hello" as const;
console.log(hello);
$ esyes hi.ts
hello
All node flags and environment variables are passed through to node, so it's a
true drop-in replacement for the node
command.
There's one divergence:
node
without any arguments will run the Node REPL, whileesyes
with no arguments prints usage information.
You can use esyes
directly as a Node
loader without any
experimental warnings.
$ cat hi.ts
const hello = "hello" as const;
console.log(hello);
$ node --import esyes hi.ts
hello
esyes
uses Node's new module.register API. This is the API that the warnings you might have seen advise you to use.
import.meta.env
Supportesyes
will automatically transform many of the import.meta.env
features
supported by Vite so that you can
use them directly in your JavaScript or TypeScript code.
$ cat hi.ts
const hello = "hello" as const;
if (import.meta.env.DEV) {
console.log(hello);
} else {
console.log("not in dev mode!");
}
$ node --import esyes hi.ts
hello
$ MODE=prod node --import esyes hi.ts
not in dev mode
This transform applies to all files, including files in your node_modules
,
which makes using import.meta.env
transparent, even if some of the code you're
working on is in node_modules (such as when working in monorepos).
The transform is expected to be extremely fast when no import.meta.env
is used
(it just does a quick check for import.meta.env
before doing any other work).
If the loader isn't doing what you expect, you can enable trace logging to see all of the files that the loader is processing, and the processing steps it's taking.
$ cat hi.ts
const hello = "hello" as const;
if (import.meta.env.DEV) {
console.log(hello);
} else {
console.log("not in dev mode!");
}
$ EYES_LOADER_LOG=log.txt node --import esyes hi.ts
hello
$ cat log.txt
load: "file:///.../hi.ts"
search for "import.meta.env" (from 0):
found at: 23
lookahead for ".":
found: "38..39"
lookahead for /^(MODE|DEV|PROD|TRACE)/:
found: "39..42"
replacing:
range: "23..42"
with: "true"
search for "import.meta.env": "not found"
MIT © 2023 Yehuda Katz
FAQs
Run your TypeScript files quickly and with more positivity.
The npm package esyes receives a total of 44 weekly downloads. As such, esyes popularity was classified as not popular.
We found that esyes demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A threat actor's playbook for exploiting the npm ecosystem was exposed on the dark web, detailing how to build a blockchain-powered botnet.
Security News
NVD’s backlog surpasses 20,000 CVEs as analysis slows and NIST announces new system updates to address ongoing delays.
Security News
Research
A malicious npm package disguised as a WhatsApp client is exploiting authentication flows with a remote kill switch to exfiltrate data and destroy files.