Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
i18n-core is a no-fuzz Node.js implementation of i18n. It doesn't connect to express or any other fancy Node framework and is extensible where it needs to be and allows to reduce the complexity of other i18n implementations (thus the name).
It implements basic variable replacements in the mustache and sprintf manner.
To use i18n-core all you need to do is install it using npm
$ npm i i18n-core --save
var i18n_core = require("i18n-core")
var i18n = i18n_core({greeting: "hello!"})
i18n.__("greeting") // hello!
To have different namespaces for different languages you can get a prefixed subpart using .lang()
.
var i18n = i18n_core({
en: { greeting: "hello!" },
de: { greeting: "guten tag!"}
})
var en = i18n.lang("en")
en.__("greeting") // hello!
var de = i18n.lang("de")
de.__("greeting") // guten tag!
Note: .lang(<lang>)
is the same thing as .sub(<lang> + ".")
The system is based on lookup
implementations that allow the system to use different sources to get its strings from. The examples before used an object and because of this the former example would be equal to:
var i18n = i18n_core(require("i18n-core/lookup/object")({greeting: "hello!"}))
If you were to pass in a string to i18n-core
instead like this:
var i18n = i18n_core("./")
Then it would be equal the primitive file-system lookup same like this:
var i18n = i18n_core(require("i18n-core/lookup/fs")("./"))
You can pass in your own strategy by given an object to the constructor that contains a "get"-method:
var i18n = i18n_core({
get: function (key) {
return null; // Who needs translation anyway?
}
})
In case you need to have several strategies that need to be chained you can use the chain lookup:
var i18nChain = require("i18n-core/lookup/chain")
var i18nObject = require("i18n-core/lookup/object")
var i18n = i18n_core(i18nChain(i18nObject({a: "x"}), i18nObject({a: 0, b: 1})))
i18n.__('a') // x
i18n.__('b') // 1
In case you have an i18n
object that you want to use as lookup for another i18
object you can extend them:
var i18nExtend = require("i18n-core/lookup/extend")
var i18nObject = require("i18n-core/lookup/object")
var i18nA = i18n({a: "x"})
var i18nB = i18n(i18nExtend(i18nA, i18nObject({
b: 1
})))
i18n.__('a') // x
i18n.__('b') // 1
i18n-core does implement basic placeholder replacements like:
en.__("%s is cool", "he"); // "he is cool"
following the logic of sprintf.
It also offers mustache pattern replacement like this:
en.__("{{name}} are cool too", {name: "you"}); // "you are cool too"
It is possible to chain translation prefixes like this:
var at = i18n_core({de:{at: {hello: "Zewas!"}}}).lang("de").lang("at");
at.__("hello") // Zewas!
and you can also change the chain if you want to.
var translate = i18n_core({
de: {title: "Meine Webseite"},
en: {title: "My Website"}
}).lang("de", true) // <- this true is important :)
translate.__("title") // Meine Website
translate.changeLang("en")
translate.__("title") // My Website
To prevent malicious use the changing of the language is prevented unless you pass a true
flag to it.
In some instances it is necessary to know in advance if a key has a value or not, in this case you can use has
.
var translate = i18n_core({title: "My Website"})
translate.has("title") // true
translate.has("subtitle") // false
Additionally, for module development, its possible to access the raw data using raw
:
var translate = i18n_core({no: {val: 5}})
translate.raw("no") // {val: 5}
If you have any questions, please post them as issue, thanks!
FAQs
Basic i18n translation.
We found that i18n-core demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.