
Research
Malicious npm Packages Impersonate Flashbots SDKs, Targeting Ethereum Wallet Credentials
Four npm packages disguised as cryptographic tools steal developer credentials and send them to attacker-controlled Telegram infrastructure.
frozen-fruit
Advanced tools
frozen-fruit
is a utility script that extracts and "freezes" global objects, properties, and methods into a secure, immutable namespace called primordials
. This ensures that you can access and use key built-in properties without the risk of them being modified or tampered with by the surrounding environment.
The module achieves this by copying and unbinding all relevant global properties, including their prototypes, into a new object. It handles accessor properties (getters and setters) as well as regular properties. The final object is frozen to prevent further modifications, securing the environment from unintended changes to the primordials.
this
context.primordials
object is frozen, making it immutable.After importing the module, you can access built-in global properties through the frozen primordials
object. This makes it ideal for environments where you want to prevent accidental or malicious modifications to the global object.
const primordials = require('frozen-fruit');
// Access a frozen global object
console.log(primordials.MathSin); // Unbound sine function from Math.prototype
// Attempting to modify the primordials will throw an error
primordials.Math = {}; // Error: Cannot assign to read only property 'Math'
The module provides an object where each primordial is organized as follows:
MathSin
, MathCos
, etc.Prototype
.
ArrayPrototypeMap
, StringPrototypeSplit
, etc.Get
and Set
respectively.
ElementGetId
, WindowSetTitle
.You can also use the GetPrimordial()
function directly to copy properties from a specific source:
const { GetPrimordial } = require('frozen-fruit');
// Extract properties from a custom object
const myPrimordials = GetPrimordial(SomeGlobalObject);
Simply add the frozen-fruit
file to your project and require it wherever you need access to immutable global properties.
Object.getOwnPropertyNames(globalThis)
to gather a set of all global properties.Reflect.ownKeys()
to iterate over the properties and Reflect.getOwnPropertyDescriptor()
to extract detailed property descriptors (including getters, setters, etc.).Function.prototype.call.bind()
, preventing their internal this
from being altered.primordials
object is frozen using Object.freeze()
.FAQs
Don't get userland get to you... use frozen-fruit!
The npm package frozen-fruit receives a total of 0 weekly downloads. As such, frozen-fruit popularity was classified as not popular.
We found that frozen-fruit demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Four npm packages disguised as cryptographic tools steal developer credentials and send them to attacker-controlled Telegram infrastructure.
Security News
Ruby maintainers from Bundler and rbenv teams are building rv to bring Python uv's speed and unified tooling approach to Ruby development.
Security News
Following last week’s supply chain attack, Nx published findings on the GitHub Actions exploit and moved npm publishing to Trusted Publishers.