
Research
PyPI Package Disguised as Instagram Growth Tool Harvests User Credentials
A deceptive PyPI package posing as an Instagram growth tool collects user credentials and sends them to third-party bot services.
Fixd is a JavaScript library for creating reference-free, immutable (frozen) objects. It supports immutability on all native types, including deeply nested objects and arrays.
The use-case Fixd was built around is "locking" reusable fixtures to prevent mutations, an in-turn, side-effects during testing.
npm i fixd --save
'use strict'
const fixd = require('fixd')
// Add a new object
fixd.foo = {
fizz: 'buzz',
baz: {
quz: 'baz'
}
}
// Access object
fixd.foo // -> { fizz: 'buzz', baz: { quz: 'baz' } }
// Throws error, prevents mutations
foo.fizz = 'bazz' // -> ERROR: Cannot assign to read only property
Note: While Object.freeze
will prevent modifications, use strict
must be applied to the document in order to throw an error on attempted mutation.
Because the objects are frozen, Fixd provides the create
method for returning a new, modified instance.
fixd.create('foo', (foo) => {
foo.fizz = 'bazz'
return foo
}) // -> { fizz: 'bazz', baz: { quz: 'baz' } }
The above will not modify the foo
object, it will return a new, reference-free, frozen instance of the object based on the modification performed in the callback.
The prefered dependency manager for Fixd is Yarn. To run tests, execute the following after dependencies have been installed:
yarn test
Fixd is developed and maintained by TechnologyAdvice and released under the ISC license.
FAQs
Test fixture utility
The npm package fixd receives a total of 217 weekly downloads. As such, fixd popularity was classified as not popular.
We found that fixd demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
A deceptive PyPI package posing as an Instagram growth tool collects user credentials and sends them to third-party bot services.
Product
Socket now supports pylock.toml, enabling secure, reproducible Python builds with advanced scanning and full alignment with PEP 751's new standard.
Security News
Research
Socket uncovered two npm packages that register hidden HTTP endpoints to delete all files on command.