Security News
The Risks of Misguided Research in Supply Chain Security
Snyk's use of malicious npm packages for research raises ethical concerns, highlighting risks in public deployment, data exfiltration, and unauthorized testing.
gen-uniqueid
Advanced tools
`vm-node` 是一款Node端代码沙箱,在`vm2`的基础上,额外解决了代码死循环、各类异常捕获等问题,沙箱内能`共享`所处运行环境的node_module中已安装的包
vm-node
是一款Node端代码沙箱,在vm2
的基础上,额外解决了代码死循环、各类异常捕获等问题,沙箱内能共享
所处运行环境的node_module中已安装的包
const {createVM} = require('vm-node');
const vm = createVM({timeout: 30000})
// 或
const vm = createVM() // 默认超时时长:10s
// 正常使用1
vm.run('hooks.onFinished({name: "andy"})').then((data) => {
console.log(data) // {name: "andy"}
})
// 正常使用2
vm.run(`
const axios = require('axios');
const wrapper = async () => {
try {
const res = await axios.get("http://localhost:8080/api/test");
// 将结果传递至外部,并标记执行结束
hooks.onFinished(res.data)
} catch(e) {
logger.log('出错了')
logger.log(e.message)
}
}
wrapper()
`).then(data => {
console.log('沙箱执行结果是', data)
})
// 捕获内部错误1
vm.run('logger.log(a)').catch(e => {
console.log('外部收到错误', e)
})
// 捕获内部错误2
vm.run(`Promise.reject('这是Promise错误信息')`).catch(e => {
console.log('外部收到错误', e)
})
// 捕获内部错误3
vm.run('process.exit()').catch(e => {
console.log('外部收到错误', e)
})
hooks.onFinished
方法进行传递FAQs
基于雪花算法的自增id生成器
We found that gen-uniqueid demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Snyk's use of malicious npm packages for research raises ethical concerns, highlighting risks in public deployment, data exfiltration, and unauthorized testing.
Research
Security News
Socket researchers found several malicious npm packages typosquatting Chalk and Chokidar, targeting Node.js developers with kill switches and data theft.
Security News
pnpm 10 blocks lifecycle scripts by default to improve security, addressing supply chain attack risks but sparking debate over compatibility and workflow changes.