
Security News
vlt Launches "reproduce": A New Tool Challenging the Limits of Package Provenance
vlt's new "reproduce" tool verifies npm packages against their source code, outperforming traditional provenance adoption in the JavaScript ecosystem.
evidence-connector-js
Advanced tools
This is a JavaScript source plugin for Evidence. It allows you to run arbitrary JavaScript code as a data source. It's meant to be a quick way to get data into Evidence without having to create a new connector.
This is a JavaScript source plugin for Evidence. It allows you to run arbitrary JavaScript code as a data source. It's meant to be a quick way to get data into Evidence without having to create a new connector.
npm install evidence-connector-js
datasources:
evidence-connector-js: {}
npm run dev
and navigate to the settings menu (localhost:3000/settings) to add a data source using this plugin.pokedex.js
. The JS file should export a data
object.
let url = 'https://pokeapi.co/api/v2/pokemon/'
const response = await fetch(url)
const json = await response.json()
const data = json.results
export { data }
```sql pokedex
select * from pokedex
```
You can pass credentials via environment variables to your JS file. They must be prefixed with EVIDENCE_
.
let key = process.env.EVIDENCE_API_KEY
let url = 'https://whatever.com/api'
const response = await fetch(url, {
headers: {
'x-api-key': key
}
})
const json = await response.json()
const data = json.results
export { data }
FAQs
This is a JavaScript source plugin for Evidence. It allows you to run arbitrary JavaScript code as a data source. It's meant to be a quick way to get data into Evidence without having to create a new connector.
We found that evidence-connector-js demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
vlt's new "reproduce" tool verifies npm packages against their source code, outperforming traditional provenance adoption in the JavaScript ecosystem.
Research
Security News
Socket researchers uncovered a malicious PyPI package exploiting Deezer’s API to enable coordinated music piracy through API abuse and C2 server control.
Research
The Socket Research Team discovered a malicious npm package, '@ton-wallet/create', stealing cryptocurrency wallet keys from developers and users in the TON ecosystem.