
Research
Shai-Hulud Descends to Hades: Miasma Worm Campaign Spreads with New PyPI Wave
Socket found 37 malicious PyPI wheels that abuse Python startup hooks to launch a Bun-powered credential stealer tied to Mini Shai-Hulud/Miasma.
Switchable, modular, stackable features for your code. Turn on any transformations you'd like to use.
Usage example:
[jann@Jann-PC tmp]$ cat test.xjs
// :X-FEATURE: destructure
var a, b, c;
var val = [{x: 5, y: 6}, 7];
[{x: a, y: b}, c] = val;
console.log('how it should be: a=5='+a+', b=6='+b+', c=7='+c);
[jann@Jann-PC tmp]$ node
> require('features')
{}
> require('./test')
how it should be: a=5=5, b=6=6, c=7=7
{}
So, basically, for people who want to use such features:
feature-<name> modules for the features you want.xjs as file extensionrequire('features')// :X-FEATURE: destructureNote that your main script can't use such features - you might want to use a shim script.
Also note that although this module should just work, the destructure feature doesn't do some important things as of 15.01.2012
(most importantly, caching results).
For people who want to make features:
feature-<name>transformCodeString(code) to the exportsSee https://github.com/thejh/node-feature-destructure/ for an example.
FAQs
per-file switchable code pre-transformations
The npm package features receives a total of 32 weekly downloads. As such, features popularity was classified as not popular.
We found that features demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Socket found 37 malicious PyPI wheels that abuse Python startup hooks to launch a Bun-powered credential stealer tied to Mini Shai-Hulud/Miasma.

Security News
RubyGems and Bundler 4.0.13 introduced an opt-in cooldown feature that delays newly published gems during dependency resolution.

Security News
pnpm 11.5 now recognizes npm staged publish approvals in release metadata, preventing those releases from being mistaken for lower-trust package publishes.