Research
Security News
Threat Actor Exposes Playbook for Exploiting npm to Build Blockchain-Powered Botnets
A threat actor's playbook for exploiting the npm ecosystem was exposed on the dark web, detailing how to build a blockchain-powered botnet.
Use Javascript where you would ordinarily use PHP or some templating language.
This has just been hacked together, so expect a bumpy ride.
$ echo "1::b::3" | htmx --context "{b:'2'}"
→ 123
Default script delimiters are the same for left and right side. Double
colon ::
was chosen for it's scarse use in websites source-code.
You can set it up with ['<\\?', '\\?>']
delimiters for PHP-like short tags.
If your Javascript returns an object structure instead of a text response, (say
some vDOM) you can use the preprocess()
function to layout the final output.
npm install -g htmx
var
fs= require('fs'),
htmx= require('htmx')()
fs.writeFileSync(
'test.html', // → "123"
htmx(
fs.readFileSync('test.htmx').toString(), // → "1::b::3"
fs.readFileSync('test.js').toString() // → "{b:2}"
))
$ cat index.html
→ "1::b::3"
$ cat index.js
→ {b:'2'}
$ htmx --context index.js --template index.html
→ 123
// -c can be a JSON string
// if -t is missing, STDIN is used instead
$ htmx --root . --build ../build // see TODO.md
// builds current dir, using index.js for context, if exists
All shell options can be shortened, as long as they are distinguishable.
So the --root
option can become -r
and the --context
option can become -c
Use the --delimiter
option like so: htmx -d \\\{\\\{ \\\}\\\}
. Yes, I know.
RegExp escape, shell escape, no quotes, weird space in the middle. PRs welcome.
The preprocess()
function lives in the preprocess.js
module, which
you will have to hack on. PRs welcome.
PHP is way too clunky still. Things like Jinja's filter pipes in Javascript naturally become chains, the script return value naturally becomes the response, I mean, I didn't do much to make all this work, not at all.
Javascript is a fine templating language, when used like this.
FAQs
Use Javascript in place of PHP
The npm package htmx receives a total of 311 weekly downloads. As such, htmx popularity was classified as not popular.
We found that htmx demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A threat actor's playbook for exploiting the npm ecosystem was exposed on the dark web, detailing how to build a blockchain-powered botnet.
Security News
NVD’s backlog surpasses 20,000 CVEs as analysis slows and NIST announces new system updates to address ongoing delays.
Security News
Research
A malicious npm package disguised as a WhatsApp client is exploiting authentication flows with a remote kill switch to exfiltrate data and destroy files.