
Security News
/Research
Wallet-Draining npm Package Impersonates Nodemailer to Hijack Crypto Transactions
Malicious npm package impersonates Nodemailer and drains wallets by hijacking crypto transactions across multiple blockchains.
A micro templating engine inspired by Handlebars, but with several notable changes designed to make it more versatile and significantly smaller. Handybars is not Handlebars compatible and cannot be used as a drop in replacement, but the syntax is very similar.
Note, this project is very much a work in progress, the api and behavior can and will change.
handybars.partial(templateText)
(or import { partial } from 'handybars'
) to parse a partial template.template.setPartial(name, templateText)
to add a partial to a template's environment scope.../
does not exist. Instead, use @parent.
to access the previous scope. However, you may find you don't need this unless a local scope's keys collide with a parent scope's keys.as
syntax, such as {{#each users as | user |}}
{{#each}}
can iterate any Array, Set, Map or plain Object.{{#each [ '1st' '2nd' '3rd' ]}}
{{order[request.id].creationDate}}
value.[N]
lookup syntax (note the period before the bracket)npm install handybars
In CommonJS:
const handybars = require('handybars');
In ES6:
import handybars from 'handybars';
Usage:
const template = handybars("<p>{{author.first}} {{author.last}}</p>");
const html = template({
author: {
first: 'John',
last: 'Doe',
}
});
Any property can be used as a boolean truthy check.
handybars(`
<div class="entry">
<h1>{{book.title}}</h1>
{{#author}}<h2>{{book.author.first}} {{book.author.last}}</h2>{{/author}}
</div>
`)({
book: {
title: 'Mort'
author: {
first: 'Terry',
last: 'Pratchett',
}
}
})
Any property that is a function will be executed as a helper.
handybars(`
{{lcase "HELLO"}}
`)({
lcase: (s) => s.toLowerCase(),
})
Arrays can be created inline in logic blocks
handybars(`
{{#each [ '1st' 2 third ]}}
`)({
third: '3rd'
})
FAQs
A light-weight templating engine inspired by Handlebars
We found that handybars demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
/Research
Malicious npm package impersonates Nodemailer and drains wallets by hijacking crypto transactions across multiple blockchains.
Security News
This episode explores the hard problem of reachability analysis, from static analysis limits to handling dynamic languages and massive dependency trees.
Security News
/Research
Malicious Nx npm versions stole secrets and wallet info using AI CLI tools; Socket’s AI scanner detected the supply chain attack and flagged the malware.