Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Insecable is a module that aims at adding non-breaking spaces where relevant in an HTML string.
Its name comes from the french name "Espace insécable" that means non-breaking space.
To add insecable to your project run
npm install --save insecable
The patching operation is driven by one or more set of rules. There are so far 3 types of possible replacements:
leading
that aims at replacing a leading space (e.g <space>!
, <space>»
)trailing
that aims at replacing a trailing space (e.g ,<space>
«<space>
)nested
that aims at replacing the space after the opening symbol and the space before the closing symbol (e.g –<space>some text<space>–
)const {insecable} = require('insecable');
// French punctuation marks ruleset Cherry picked from
// https://github.com/morgaan/insecable/blob/master/src/rulesets/fr-FR.js.
const ruleset = {
' ': {
leading: [
'!', ';', '?'
]
},
' ': {
leading: [
'»', ':'
],
trailing: [
'«'
],
nested: [
'–'
]
}
};
const input = `
Ça alors !
Je ne l'avais jamais vu ; ces espaces me semblent bizarres.
Exemple : le deux-points qui se dit parfois double point.
« Bonjour ! »
Il ne faut pas confondre le tiret d'incise et le trait d'union – qui est nettement plus court – même si l'erreur est fréquente.
`;
const patchedInput = insecable(input, ruleset);
// patchedInput should now be equal to:
//
// Ça alors !
// Je ne l'avais jamais vu ; ces espaces me semblent bizarres.
// Exemple : le deux-points qui se dit parfois double point.
// « Bonjour ! »
// Il ne faut pas confondre le tiret d'incise et le trait d'union – qui est nettement plus court – même si l'erreur est fréquente.
Contributions are always welcome. Before contributing please search the issue
tracker; your issue may have
already been discussed or fixed in master
. To contribute,
clone
, commit your changes, & send a pull
request.
This module is architectured in a way that rulesets can be extended and/or contributed.
Please make sure to always:
./src/rulesets/fr-FR.js
, ./src/rulesets/fr-FR.test.js
and
./src/rulesets/index.js
to get a grip on how this all work together.So far this repository only contains rules for the French language, and more precisely for the french punctuation marks. There is much more that can be added, at least for the french language according to the book: Lexique des règles typographiques en usage à l'Imprimerie nationale, 5th edition, Paris, 2002. ISBN 2-7433-0482-0., for instance for dates, measure/military units... This may come in future releases, but feel free to contribute this may then be quicker ;).
In addition to the following guidelines, please follow the conventions already established in the code.
Spacing:
Use one tab for indentation. No spaces.
Naming:
Keep variable & method names concise & descriptive.
Variable names index
, array
, & error
are preferable to
i
, arr
, & e
.
Quotes:
Single-quoted strings are preferred to double-quoted strings; however,
please use a double-quoted string if the value contains a single-quote
character to avoid unnecessary escaping.
Comments:
Please use concise comments to annotate significant additions, &
JSDoc-style comments for functions.
FAQs
Aims at adding non-breaking spaces where relevant in an HTML string
The npm package insecable receives a total of 59 weekly downloads. As such, insecable popularity was classified as not popular.
We found that insecable demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.