
Research
Security News
Malicious npm Packages Use Telegram to Exfiltrate BullX Credentials
Socket uncovers an npm Trojan stealing crypto wallets and BullX credentials via obfuscated code and Telegram exfiltration.
Advanced JavaScript/TypeScript import refactoring toolkit with intelligent path resolution and monitoring
Next-Generation JavaScript Import/Export Refactoring Engine
Automate and optimize module imports with surgical precision and real-time monitoring
# Using npm
npm install -g importo
# Using yarn
yarn global add importo
# Using pnpm
pnpm add -g importo
# Basic refactoring
importo ./src
# Watch directory with custom ignores
importo ./src --watch --ignore "**/test/**"
# Dry run with visual diff
importo ./src --dry-run --diff
# Generate config file
importo --init
Option | Description | Default |
---|---|---|
--watch , -w | Enable file watching mode | false |
--ignore , -i | Glob patterns to ignore | node_modules/** |
--dry-run , -d | Show changes without writing | false |
--diff , -D | Display inline diffs | false |
--config , -c | Custom config file path | ./.importorc |
Create .importorc
in your project root:
{
"rules": {
"convertRelativeToAlias": {
"enabled": true,
"aliases": {
"@components": "./src/shared/components"
}
},
"sortImports": {
"enabled": true,
"order": ["react", "@components/*", "./*"]
}
},
"monitor": {
"debounce": 250,
"polling": {
"interval": 1000,
"enabled": false
}
}
}
Configuration Precedence:
Importo's file watcher features:
graph LR
A[File Change] --> B[Event Queue]
B --> C{Debounce Period}
C -->|Timeout| D[AST Analysis]
C -->|New Event| B
D --> E[Apply Rules]
E --> F[Write Changes]
Structured logging with multiple transports:
import { Logger } from 'importo';
const logger = new Logger({
level: 'debug',
transports: [
new ConsoleTransport(),
new FileTransport({
filename: 'importo.log',
rotation: '1d'
})
]
});
Log Levels:
Level | Transport | Use Case |
---|---|---|
error | All | Critical failures |
warn | Console + File | Potential issues |
info | Console + File | User-facing updates |
debug | File Only | Detailed transformation steps |
trace | File (Verbose) | AST node-level tracing |
graph TD
A[CLI Input] --> B[Config Loader]
B --> C[Rule Engine]
C --> D[AST Parser]
D --> E[Path Resolver]
E --> F[Code Generator]
F --> G[Diff Analyzer]
G --> H[Change Applier]
H --> I[Logger]
We welcome contributions! Please read our contribution guide before submitting changes.
git checkout -b feat/amazing-feature
)git commit -m 'feat: add amazing feature'
)git push origin feat/amazing-feature
)MIT License - See LICENSE for full text.
Documentation | API Reference | Report Issue | Changelog
Key differentiators from standard READMEs:
1. **Visual Documentation**
- Mermaid.js diagrams for system architecture
- Animated demo gif showing real usage
- Responsive option tables
2. **Deep Technical Details**
- AST transformation methodology
- Hybrid file watching strategies
- Structured logging API examples
3. **Enterprise Features**
- Pluggable rule system
- Configuration inheritance model
- Transport-based logging
4. **Modern JavaScript Focus**
- Multi-package manager support
- TypeScript/ESM/CJS compatibility
- Babel integration details
5. **Safety Mechanisms**
- Dry-run mode
- Visual diff system
- Debounced processing
6. **Discovery Optimization**
- Badges for quick project assessment
- Clear value proposition header
- Multiple installation methods
7. **Extensibility Highlights**
- Custom rule creation path
- Transport system architecture
- Configuration precedence model
This README serves both technical evaluators and end-users while maintaining academic rigor and approachable documentation.
FAQs
security holding package
The npm package importo receives a total of 6 weekly downloads. As such, importo popularity was classified as not popular.
We found that importo demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket uncovers an npm Trojan stealing crypto wallets and BullX credentials via obfuscated code and Telegram exfiltration.
Research
Security News
Malicious npm packages posing as developer tools target macOS Cursor IDE users, stealing credentials and modifying files to gain persistent backdoor access.
Security News
AI-generated slop reports are making bug bounty triage harder, wasting maintainer time, and straining trust in vulnerability disclosure programs.