Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
FIXME label that will remind you to go back and fix it.
Idea based on fixme for ruby.
First, you will have to install the module.
npm install fixme-js
var FIXME = require('fixme-js');
// ...
FIXME('12/31/1999: Close doors of cryogenic pods.');
<script src="[path/to/node_modules]/fixme-js/dist/fixme.js"></script>
<script>FIXME('12/31/1999: Close doors of cryogenic pods.');</script>
And when current date will be past the current date, it will throw an error like this:
FIXME::UnfixedError: Fix by 12/31/1999: Close doors of cryogenic pods.
FIXME("{date}:{label}" [, opts])
: a single string argument of date and time, split by a :
FIXME("{date}", "{label}" [, opts])
: date in string format and labelFIXME({date}, "{label}" [, opts])
: date as an object and labelThe "{date}"
is any string, which can be parsed into a valid date via JavaScript's Date.parse
or new Date
.
For each of this calls, opts
is an optional object argument of options.
Currently supported options:
skipProd
: If true, throwing an error is skipped in production environments - determined via process.env.NODE_ENV
. (default: true
)The FIXME
label is evaluated at runtime, therefore it's call takes some execution time. Based on my simple benchmark with 1M calls, one call takes about 50 µs (0.05 ms) if the exception is thrown or 2 µs (0.002 ms) just to make the check. To some it might not seem like a lot, but it has the potential make a significant impact on performance.
If you spotted a bug or have an idea for improvement, let me know under issues section.
To tinker with the code on your own:
npm install
to get all the dev dependencies (required to run tests)Code for the FIXME
module is located within *.js files tests are inside test/* folder.
FAQs
FIXME label that will remind you to go back and fix it.
The npm package fixme-js receives a total of 0 weekly downloads. As such, fixme-js popularity was classified as not popular.
We found that fixme-js demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.