Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
extensionless
Advanced tools
Node.js loader for import specifiers as file paths without extensions or as directory paths
Node.js loader for import specifiers as file paths without extensions or as directory paths
Install:
npm i extensionless
Start node
with one of the following flags added. If you're running on a version of node older than 20.6.0
, use:
--experimental-loader=extensionless
or else, use the newer one instead:
--import=extensionless/register
You can now use import specifiers as file paths without extensions or as directory paths:
// imports from the first existing file in the candidates list as follows
import mod from './mod'
// ['./mod.js', './mod/index.js']
import mod from '../mod' with {type: 'json'}
// ['../mod.json', '../mod/index.json']
import api from '/apps/api'
// ['/apps/api.js', '/apps/api/index.js']
import web from 'file:///apps/web'
// ['file:///apps/web.js', 'file:///apps/web/index.js']
To configure this module, add the field extensionless
to your project's package.json
:
"extensionless": {
"lookFor": ["js", "mjs", "cjs"]
}
Field | Default Value |
---|---|
lookFor | ["js"] |
When it can be deduced from the specifier that its target is a directory, the resolver looks for only the index files:
// imports from the first existing file in the candidates list as follows
import cur from '.'
// ['./index.js']
import up from '..'
// ['../index.js']
import mod from './mod/'
// ['./mod/index.js']
import mod from '../mod/' with {type: 'json'}
// ['../mod/index.json']
import api from '/apps/api/'
// ['/apps/api/index.js']
import web from 'file:///apps/web/'
// ['file:///apps/web/index.js']
This loader also adds support for Windows path resolution with which you can use forward or backward slashes as separators.
import mod from '.\\mod'
// ['./mod.js', './mod/index.js']
import mod from '..\\mod\\' with {type: 'json'}
// ['../mod/index.json']
import api from 'C:/apps/api'
// ['/C:/apps/api.js', '/C:/apps/api/index.js']
import web from 'C:\\apps\\web\\'
// ['/C:/apps/web/index.js']
FAQs
Node.js loader for import specifiers as file paths without extensions or as directory paths
The npm package extensionless receives a total of 32,845 weekly downloads. As such, extensionless popularity was classified as popular.
We found that extensionless demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.