Security News
tea.xyz Spam Plagues npm and RubyGems Package Registries
Tea.xyz, a crypto project aimed at rewarding open source contributions, is once again facing backlash due to an influx of spam packages flooding public package registries.
isbot
Advanced tools
Changelog
Readme
Recognise bots/crawlers/spiders using the user agent string.
import { isbot } from "isbot";
// Nodejs HTTP
isbot(request.getHeader("User-Agent"));
// ExpressJS
isbot(req.get("user-agent"));
// Browser
isbot(navigator.userAgent);
// User Agent string
isbot(
"Mozilla/5.0 (iPhone; CPU iPhone OS 6_0 like Mac OS X) AppleWebKit/536.26 (KHTML, like Gecko) Version/6.0 Mobile/10A5376e Safari/8536.25 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)",
); // true
isbot(
"Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36",
); // false
Using JSDeliver CDN you can import an iife script
See specific versions https://www.jsdelivr.com/package/npm/isbot or https://cdn.jsdelivr.net/npm/isbot
<script src="https://cdn.jsdelivr.net/npm/isbot@4"></script>
// isbot is global isbot(navigator.userAgent)
isbot
maintains accuracy
isbot
's prized possession is the accurate identification of bots using a regular expression. It uses expansive and regularly updated lists of user agent strings to create a regular expression that matches bots and only bots.This is done by using a lookbehind pattern which is not supported in all environments. A fallback is provided for environments that do not support lookbehind which is less accurate. The test suite includes a percentage of false positives and false negatives which is deemed acceptable for the fallback: 1% false positive and 75% bot coverage.
import | Type | Description |
---|---|---|
isbot | (string?): boolean | Check if the user agent is a bot |
isbotNaive | (string?): boolean | Check if the user agent is a bot using a naive pattern (less accurate) |
getPattern | (): RegExp | The regular expression used to identify bots |
list | string[] | List of all individual pattern parts |
isbotMatch | (string?): string | null | The substring matched by the regular expression |
isbotMatches | (string?): string[] | All substrings matched by the regular expression |
isbotPattern | (string?): string | null | The regular expression used to identify bot substring in the user agent |
isbotPatterns | (string?): string[] | All regular expressions used to identify bot substrings in the user agent |
createIsbot | (RegExp): (string?): boolean | Create a custom isbot function |
createIsbotFromList | (string[]): (string?): boolean | Create a custom isbot function from a list of string representation patterns |
Create a custom isbot that does not consider Chrome Lighthouse user agent as bots.
import { createIsbotFromList, isbotMatches, list } from "isbot";
const ChromeLighthouseUserAgentStrings: string[] = [
"mozilla/5.0 (macintosh; intel mac os x 10_15_7) applewebkit/537.36 (khtml, like gecko) chrome/94.0.4590.2 safari/537.36 chrome-lighthouse",
"mozilla/5.0 (linux; android 7.0; moto g (4)) applewebkit/537.36 (khtml, like gecko) chrome/94.0.4590.2 mobile safari/537.36 chrome-lighthouse",
];
const patternsToRemove: Set<string> = new Set(
ChromeLighthouseUserAgentStrings.map(isbotMatches).flat(),
);
const isbot = createIsbotFromList(
list.filter((record) => patternsToRemove.has(record) === false),
);
Create a custom isbot that considers another pattern as a bot, which is not included in the package originally.
import { createIsbotFromList, list } from "isbot";
const isbot = createIsbotFromList(list.concat("shmulik"));
This package aims to identify "Good bots". Those who voluntarily identify themselves by setting a unique, preferably descriptive, user agent, usually by setting a dedicated request header.
It does not try to recognise malicious bots or programs disguising themselves as real users.
Recognising good bots such as web crawlers is useful for multiple purposes. Although it is not recommended to serve different content to web crawlers like Googlebot, you can still elect to
It is not recommended to whitelist requests for any reason based on user agent header only. Instead other methods of identification can be added such as reverse dns lookup.
We use external data sources on top of our own lists to keep up to date
Missing something? Please open an issue
Remove named export "pattern" from the interface, instead use "getPattern" method
Remove isbot
function default export in favour of a named export.
import { isbot } from "isbot";
Remove testing for node 6 and 8
Change return value for isbot: true
instead of matched string
No functional change
FAQs
🤖/👨🦰 Recognise bots/crawlers/spiders using the user agent string.
The npm package isbot receives a total of 416,733 weekly downloads. As such, isbot popularity was classified as popular.
We found that isbot demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Tea.xyz, a crypto project aimed at rewarding open source contributions, is once again facing backlash due to an influx of spam packages flooding public package registries.
Security News
As cyber threats become more autonomous, AI-powered defenses are crucial for businesses to stay ahead of attackers who can exploit software vulnerabilities at scale.
Security News
UnitedHealth Group disclosed that the ransomware attack on Change Healthcare compromised protected health information for millions in the U.S., with estimated costs to the company expected to reach $1 billion.