
Research
/Security News
Intercom’s npm Package Compromised in Ongoing Mini Shai-Hulud Worm Attack
Compromised intercom-client@7.0.4 npm package is tied to the ongoing Mini Shai-Hulud worm attack targeting developer and CI/CD secrets.
firestruct
Advanced tools
npm install firestruct
import Firestruct from "firestruct";
const count = c => c.value();
const increment = c => c.update(i => i + 1);
const fs = new Firestruct("https://test.firebaseio.com/clickcount");
fs.on("swap", (newCursor, oldCursor, path) => {
const clicksCursor = newCursor.cursor("clicks");
React.render(
<ClickCount
count={ count(clicksCursor) }
onClick={ event => increment(clicksCursor) } />,
document.body
);
);
on(eventName, callback)Event handler. Provides callback with 3 arguments:
Events:
"swap": data changestructure._fbDeprecated. Reference to raw Firebase object.
Please make note of any use; it should be unnecessary for all but Auth.
Cursors are immutable references to the current structure.
cursor.cursor(path)Returns a new cursor.
path is an array/string pointing to a child location.
cursor.value()Returns the value of the current cursor
cursor.update(callback)Replaces the value of the current cursor with the return value of callback. TODO: Returns the new cursor.
callback is provided with the current value of the cursor as the first argument.
New branches may be created by selecting a non-existant path, then calling update with some data.
Old branches may be deleted by selecting a path, then setting it as undefined.
cursor.cursors()Convenience function. Returns an array of child [key, cursor] pairs.
cursor._fbDeprecated. Reference to raw Firebase snapshot.
Please make note of any use; it should be unnecessary. Tree-climbing and current node keys will never be supported.
FAQs
Minimal immutable Firebase API
The npm package firestruct receives a total of 5 weekly downloads. As such, firestruct popularity was classified as not popular.
We found that firestruct demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Compromised intercom-client@7.0.4 npm package is tied to the ongoing Mini Shai-Hulud worm attack targeting developer and CI/CD secrets.

Research
Socket detected a malicious supply chain attack on PyPI package lightning versions 2.6.2 and 2.6.3, which execute credential-stealing malware on import.

Research
A brand-squatted TanStack npm package used postinstall scripts to steal .env files and exfiltrate developer secrets to an attacker-controlled endpoint.