
Security News
Feross on TBPN: How North Korea Hijacked Axios
Socket CEO Feross Aboukhadijeh breaks down how North Korea hijacked Axios and what it means for the future of software supply chain security.
ghostly-loader
Advanced tools
[](https://opensource.org/licenses/MIT)
A wepback loader which allows developers to write alternate versions of your code (AKA ghosts), which are inserted into your codebase during bundling.
Developers can then control which version of their code executes at run time.
Try using ghostly for:
The loader is built to work in tandem with the ghostly-controller, which is a library for helping you orchestrate when your ghosts should appear:
npm i --save-dev ghostly-loader
npm i --save ghostly-controller
or
yarn add -D ghostly-loader
yarn add ghostly-controller
ghostly-controlleris not actually required to useghostly, more on this below.
In webpack.config.js
module.exports = {
// ...
module: {
rules: [
// ...
{ test: /\.js$/, use: 'ghostly-loader' },
],
}
}
As of writing, ghosts can be created only with function declarations.
If in your source code you have a function that returns a greeting:
src/index.js
require('ghostly-controller')();
function myGreeting() {
return "Hello!"
}
Then, in a separate file, you can write a ghost which will return a different greeting. Just make sure that the substitute code is in a file named with the pattern [target_file_name].ghost.js:
src/index.ghost.js
function myGreeting$spanish() {
return "Hola!"
}
ghostly-controller places a function called determineGhost on the global scope. This function will be called with the name of the ghost and any configuration that the ghost function was created with. By default, ghostly-controller uses localStorage to help manage your ghosts; run webpack, then open localStorage in your dev tools to see the result. Try overwriting the data to control which version is run.
You can choose not to use ghostly-controller and define your own implementation in its place.
determineGhost will return either 'main' or the tag of the ghost that should be run in its place.
When 'main' is returned, the original or primary function will be used.
When the function and tag name are returned, the corresponding ghost will be used.
A single function may have many ghosts, they simply have to start with the name of the original function:
src/index.ghost.js
function myGreeting$spanish() {
return "Hola!"
}
function myGreeting$german() {
return "Hallo"
}
root
global.determineGhost = (functionName, config) => {
assert(functionName === 'myGreeting')
const ghostNames = Object.keys(config) // ['myGreeting$spanish', 'myGreeting$german']
const randomIndex = Math.floor(Math.random() * ghostNames.length)
return ghostNames[randomIndex]
}
Ghosts can be configured to run probalistically using inline comments.
Any text placed in a comment directly above your ghost will be sent to determineGhost when the function is called:
some-file.ghost.js
// 0.5
function myFunction$example() {
return "I should be used half (0.5x) the time!"
}
In determineGhost:
global.determineGhost = (functionName, config) => {
assert(functionName === 'myFunction')
assert(config.myFunction$example === 0.5)
if (functionName === 'myFunction') {
return (Math.random() > config.myFunction$example) ? 'myFunction$example' : 'main'
}
return 'main';
}
function myFunction$optionalTagName () {
// this code will run in place of the primary code.
}
FAQs
[](https://opensource.org/licenses/MIT)
We found that ghostly-loader demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Socket CEO Feross Aboukhadijeh breaks down how North Korea hijacked Axios and what it means for the future of software supply chain security.

Security News
OpenSSF has issued a high-severity advisory warning open source developers of an active Slack-based campaign using impersonation to deliver malware.

Research
/Security News
Malicious packages published to npm, PyPI, Go Modules, crates.io, and Packagist impersonate developer tooling to fetch staged malware, steal credentials and wallets, and enable remote access.