
Research
PyPI Package Disguised as Instagram Growth Tool Harvests User Credentials
A deceptive PyPI package posing as an Instagram growth tool collects user credentials and sends them to third-party bot services.
Fig is a simple and experimental user interface framework attempting to bring pug templates into the world of dynamically rendered client-side content. Not yet ready for production or anything serious, just exploring what's possible with today's javascript ecosystem. Please refer to the project's main website for a guide and api reference - fig.nikerino.com :sparkles:
Build | Size | Gzipped |
---|---|---|
fig.js | ~31kB | ~9kg |
fig.min.js | ~14kB | ~5kb |
Any updates to the installed version of the framework should be done with care, fig is at the stage where every semver minor update can break your app in unexpected and weird ways. Remember to checkout the changelog before upgrading to newer versions!
Fork & clone the repo:
$ git clone https://github.com/<username>/fig`
$ cd fig/
Get the dependencies, you know the drill. Note that this project installs a TON of packages (695 at the time of writing) if you're having troubles downloading them with npm, consider upgrading to yarn!
$ npm install
# OR
$ yarn
Start the watch scripts:
$ npm run build:watch
$ npm run test:watch
Hack away! :rocket:
Before sending any PRs, remember to run the following lint script, thank you :heart:
$ npm run lint
MIT
0.2.0 - 2017-08-08
bus.emit
function, instead of the
whole bus
object to prevent adding bus.on
listeners directly in components.fig:ready
event is now named fig ready
for a e s t h e t i c purposes.@event
listeners in components are no longer default prevented.app.opts
is now exposed at app._opts
app._tree
property.FAQs
experimental front-end js framework
The npm package figjs receives a total of 5 weekly downloads. As such, figjs popularity was classified as not popular.
We found that figjs demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
A deceptive PyPI package posing as an Instagram growth tool collects user credentials and sends them to third-party bot services.
Product
Socket now supports pylock.toml, enabling secure, reproducible Python builds with advanced scanning and full alignment with PEP 751's new standard.
Security News
Research
Socket uncovered two npm packages that register hidden HTTP endpoints to delete all files on command.