
Research
Namastex.ai npm Packages Hit with TeamPCP-Style CanisterWorm Malware
Malicious Namastex.ai npm packages appear to replicate TeamPCP-style Canister Worm tradecraft, including exfiltration and self-propagation.
figgy-pudding
Advanced tools
This module will be deprecated once npm v7 is released. Please do not rely on it more than absolutely necessary (ie, only if you are depending on it for use with npm v6 internal dependencies).
figgy-pudding is a small JavaScript
library for managing and composing cascading options objects -- hiding what
needs to be hidden from each layer, without having to do a lot of manual munging
and passing of options.
$ npm install figgy-pudding
// print-package.js
const fetch = require('./fetch.js')
const puddin = require('figgy-pudding')
const PrintOpts = puddin({
json: { default: false }
})
async function printPkg (name, opts) {
// Expected pattern is to call this in every interface function. If `opts` is
// not passed in, it will automatically create an (empty) object for it.
opts = PrintOpts(opts)
const uri = `https://registry.npmjs.com/${name}`
const res = await fetch(uri, opts.concat({
// Add or override any passed-in configs and pass them down.
log: customLogger
}))
// The following would throw an error, because it's not in PrintOpts:
// console.log(opts.log)
if (opts.json) {
return res.json()
} else {
return res.text()
}
}
console.log(await printPkg('figgy', {
// Pass in *all* configs at the toplevel, as a regular object.
json: true,
cache: './tmp-cache'
}))
// fetch.js
const puddin = require('figgy-pudding')
const FetchOpts = puddin({
log: { default: require('npmlog') },
cache: {}
})
module.exports = async function (..., opts) {
opts = FetchOpts(opts)
}
opts argument is available.get()!tap --100> figgyPudding({ key: { default: val } | String }, [opts]) -> PuddingFactoryDefines an Options constructor that can be used to collect only the needed options.
An optional default property for specs can be used to specify default values
if nothing was passed in.
If the value for a spec is a string, it will be treated as an alias to that other key.
const MyAppOpts = figgyPudding({
lg: 'log',
log: {
default: () => require('npmlog')
},
cache: {}
})
> PuddingFactory(...providers) -> FiggyPudding{}Instantiates an options object defined by figgyPudding(), which uses
providers, in order, to find requested properties.
Each provider can be either a plain object, a Map-like object (that is, one
with a .get() method) or another figgyPudding Opts object.
When nesting Opts objects, their properties will not become available to the
new object, but any further nested Opts that reference that property will be
able to read from their grandparent, as long as they define that key. Default
values for nested Opts parents will be used, if found.
const ReqOpts = figgyPudding({
follow: {}
})
const opts = ReqOpts({
follow: true,
log: require('npmlog')
})
opts.follow // => true
opts.log // => Error: ReqOpts does not define `log`
const MoreOpts = figgyPudding({
log: {}
})
MoreOpts(opts).log // => npmlog object (passed in from original plain obj)
MoreOpts(opts).follow // => Error: MoreOpts does not define `follow`
> opts.get(key) -> ValueGets a value from the options object.
const opts = MyOpts(config)
opts.get('foo') // value of `foo`
opts.foo // Proxy-based access through `.get()`
> opts.concat(...moreProviders) -> FiggyPudding{}Creates a new opts object of the same type as opts with additional providers.
Providers further to the right shadow providers to the left, with properties in
the original opts being shadows by the new providers.
const opts = MyOpts({x: 1})
opts.get('x') // 1
opts.concat({x: 2}).get('x') // 2
opts.get('x') // 1 (original opts object left intact)
> opts.toJSON() -> ValueConverts opts to a plain, JSON-stringifiable JavaScript value. Used internally
by JavaScript to get JSON.stringify() working.
Only keys that are readable by the current pudding type will be serialized.
const opts = MyOpts({x: 1})
opts.toJSON() // {x: 1}
JSON.stringify(opts) // '{"x":1}'
> opts.forEach((value, key, opts) => {}, thisArg) -> undefinedIterates over the values of opts, limited to the keys readable by the current
pudding type. thisArg will be used to set the this argument when calling the
fn.
const opts = MyOpts({x: 1, y: 2})
opts.forEach((value, key) => console.log(key, '=', value))
> opts.entries() -> Iterator<[[key, value], ...]>Returns an iterator that iterates over the keys and values in opts, limited to
the keys readable by the current pudding type. Each iteration returns an array
of [key, value].
const opts = MyOpts({x: 1, y: 2})
[...opts({x: 1, y: 2}).entries()] // [['x', 1], ['y', 2]]
> opts[Symbol.iterator]() -> Iterator<[[key, value], ...]>Returns an iterator that iterates over the keys and values in opts, limited to
the keys readable by the current pudding type. Each iteration returns an array
of [key, value]. Makes puddings work natively with JS iteration mechanisms.
const opts = MyOpts({x: 1, y: 2})
[...opts({x: 1, y: 2})] // [['x', 1], ['y', 2]]
for (let [key, value] of opts({x: 1, y: 2})) {
console.log(key, '=', value)
}
> opts.keys() -> Iterator<[key, ...]>Returns an iterator that iterates over the keys in opts, limited to the keys
readable by the current pudding type.
const opts = MyOpts({x: 1, y: 2})
[...opts({x: 1, y: 2}).keys()] // ['x', 'y']
> opts.values() -> Iterator<[value, ...]>Returns an iterator that iterates over the values in opts, limited to the keys
readable by the current pudding type.
'
const opts = MyOpts({x: 1, y: 2})
[...opts({x: 1, y: 2}).values()] // [1, 2]
yargs is a popular library for parsing command-line arguments. It provides a rich set of features for defining options, including default values, aliases, and validation. While yargs is primarily focused on command-line arguments, figgy-pudding is more general-purpose and can be used for any kind of configuration.
commander is another library for parsing command-line arguments. It offers a simple and intuitive API for defining options and commands. Like yargs, commander is focused on command-line interfaces, whereas figgy-pudding is designed for more general configuration management.
config is a library for managing configuration files in Node.js applications. It supports multiple configuration files for different environments and allows for hierarchical configurations. While config is more focused on file-based configurations, figgy-pudding provides a more flexible approach to managing options and defaults.
FAQs
Delicious, festive, cascading config/opts definitions
The npm package figgy-pudding receives a total of 2,403,597 weekly downloads. As such, figgy-pudding popularity was classified as popular.
We found that figgy-pudding demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 5 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Malicious Namastex.ai npm packages appear to replicate TeamPCP-style Canister Worm tradecraft, including exfiltration and self-propagation.

Product
Explore exportable charts for vulnerabilities, dependencies, and usage with Reports, Socket’s new extensible reporting framework.

Product
Socket for Jira lets teams turn alerts into Jira tickets with manual creation, automated ticketing rules, and two-way sync.