Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
A gulp plugin to wrap the stream contents with a lodash template.
First, install gulp-wrap
as a development dependency:
npm install --save-dev gulp-wrap
Then, add it to your gulpfile.js
:
Wrap the contents with an inline template:
var wrap = require("gulp-wrap");
gulp.src("./src/*.json")
.pipe(wrap('angular.module(\'text\', []).value(<%= contents %>);', {}, { parse: false /* do not parse the JSON file for template data */ }))
.pipe(gulp.dest("./dist"));
Wrap the contents with a template from file:
var wrap = require("gulp-wrap");
gulp.src("./src/*.json")
.pipe(wrap({ src: 'path/to/template.txt'}))
.pipe(gulp.dest("./dist"));
Use parsed contents within a template (supports JSON and YAML):
var wrap = require("gulp-wrap");
gulp.src("./src/*.json")
.pipe(wrap('Hello, <%= contents.title %>, have a <%= contents.adjective %> day.'))
.pipe(gulp.dest("./dist"));
Provide additional data and options for template processing:
var wrap = require("gulp-wrap");
gulp.src("./src/*.json")
.pipe(wrap('BEFORE <%= data.contents %> <%= data.someVar %> AFTER', { someVar: 'someVal'}, { variable: 'data' }))
.pipe(gulp.dest("./dist"));
This gulp plugin wraps the stream contents in a template. If you want the stream contents to be the templates use the gulp-template plugin.
The stream contents will be available in the template using the contents
key. If the file extension is json
, yaml
, or yml
then the contents will be parsed before being passed to the template. Properties from the vinyl file will be available in the template under the file
object and are local to that stream. User supplied data
values will always take precedence over namespace clashes with the file properties.
Type: String
or Object
or Function
The template to used. When a String
then it will be used as the template. When an Object
then the template will be loaded from file. When a Function
then the function will be called and should return the template content. This function get the data
object as first parameter.
Type: String
The file location of the template.
Type: Object
or Function
The data object that is passed on to the lodash template call. When a Function
then the function will be called and should return the Object
data used in the template.
Type: Object
or Function
The options object that is passed on to the lodash template call. When a Function
then the function will be called and should return the Object
used as the options.
Type: Boolean
Set to explicit false
value to disable automatic JSON and YAML parsing.
Type: String
Set the consolidate template engine to use. (default to lodash
).
Using another engine that lodash
may require installation of additional node package.
FAQs
A gulp plugin to wrap the stream contents with a template.
The npm package gulp-wrap receives a total of 22,244 weekly downloads. As such, gulp-wrap popularity was classified as popular.
We found that gulp-wrap demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.