
Research
/Security News
Intercom’s npm Package Compromised in Ongoing Mini Shai-Hulud Worm Attack
Compromised intercom-client@7.0.4 npm package is tied to the ongoing Mini Shai-Hulud worm attack targeting developer and CI/CD secrets.
glsl-deparser
Advanced tools
through stream that translates glsl-parser AST nodes into working glsl code
var Path = require('path')
var tokenizer = require('glsl-tokenizer')()
, parser = require('glsl-parser')
, deparser = require('glsl-deparser')
process.stdin
.pipe(tokenizer)
.pipe(parser())
.pipe(deparser()) // <-- deparser!
.pipe(process.stdout)
process.stdin.resume()
transform a stream of glsl-parser AST nodes into strings.
only operates on top-level statements emitted by glsl-parser, so the code it emits is executable
by webgl.
Creates a readable/writable stream.
If no args are provided, whitespace is assumed to be enabled, and the tab text will be ' '.
If you pass false for the first arg, only syntactically significant whitespace will be emitted (it'll behave like a poor man's minifier).
If you pass true and tab text, that tab text will be used to indent code.
the big caveat is that preprocessor if statements (#if*, #endif) won't work unless
each branch produces a parseable tree.
MIT
FAQs
through stream that translates glsl-parser AST nodes into working glsl code
The npm package glsl-deparser receives a total of 3,913 weekly downloads. As such, glsl-deparser popularity was classified as popular.
We found that glsl-deparser demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Compromised intercom-client@7.0.4 npm package is tied to the ongoing Mini Shai-Hulud worm attack targeting developer and CI/CD secrets.

Research
Socket detected a malicious supply chain attack on PyPI package lightning versions 2.6.2 and 2.6.3, which execute credential-stealing malware on import.

Research
A brand-squatted TanStack npm package used postinstall scripts to steal .env files and exfiltrate developer secrets to an attacker-controlled endpoint.