
Research
Malicious fezbox npm Package Steals Browser Passwords from Cookies via Innovative QR Code Steganographic Technique
A malicious package uses a QR code as steganography in an innovative technique.
JavaScript Annotation Transforms, or, js-@
npm install --save-dev jsat
Empower your JSDoc annotations by transforming your JavaScript to actually enforce them.
Say you maintain a package on npm with a well documented API. You have an API method that you'd like to deprecate, so you annotate it in your JSDoc block.
/**
* Add two numbers
* @deprecated addTwoNumbers() will be removed in v2.0.0; please use add()
*/
exports.addTwoNumbers(firstNumber, secondNumber) {
return firstNumber + secondNumber;
};
Awesome. Your documentation clear. But what if you wanted to actually make sure your users were aware of the upcoming breaking change? You could add a message in the function.
/**
* Add two numbers
* @deprecated addTwoNumbers() will be removed in v2.0.0; please use add()
*/
exports.addTwoNumbers(firstNumber, secondNumber) {
console.warn('addTwoNumbers() will be removed in v2.0.0; please use add()');
return firstNumber + secondNumber;
};
Better, but awfully repetitive. jsat
solves this problem by reading your source code's JSDoc comment blocks and automatically adding helpful logic that assists in enforcing supported annotations.
var jsat = require('jsat');
var fs = require('fs');
var source = fs.readFileSync('path/to/sourcefile.js', 'utf8');
var output = jsat.transform(source);
fs.writeFileSync('path/to/outputfile.js', output);
Calling jsat.transform
on the string containing your source code will do the following:
recast
For documentation on jsat
's API, please read the API Reference.
You can find example source and output files for these annotations in the examples
directory.
In future releases, I hope to provide a robust API allowing developers to create their own custom annotation types and extract oft-repeated code snippets or control structures into jsat
transformer templates.
I will also be working on plugins to allow injecting jsat
into existing build tools, such as grunt and gulp.
FAQs
An annotation-based javascript transformer
We found that jsat demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
A malicious package uses a QR code as steganography in an innovative technique.
Research
/Security News
Socket identified 80 fake candidates targeting engineering roles, including suspected North Korean operators, exposing the new reality of hiring as a security function.
Application Security
/Research
/Security News
Socket detected multiple compromised CrowdStrike npm packages, continuing the "Shai-Hulud" supply chain attack that has now impacted nearly 500 packages.