Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
将采用commonJS规范和es6的模块化代码,转译成闭包形式的代码。
npm install jsm2c -g
A simple example: the program
var jsm2c = require('./index.js');
jsm2c.setConfig({
root: '/Users/gml/github/smui-test'
})
var content = jsm2c.parse('/js/test.js');
####ns 解释:生成闭包后,所使用的命名空间 类型: string 默认值:'ns' ####root 解释:项目的根目录 类型:string 默认值:当前目录 说明:注意配置项fileBasedRoot对他的影响 ####fileBasedRoot 解释:js文件中使用require的路径是否是基于root的。 类型:boolean 默认值:false 说明:主要用于应对使用构建工具生成的文件,路径会被编译为基于项目root的相对路径,如fis ####compress 解释:分析的文件是否是被压缩过的文件 类型:boolean 默认值:false 说明:压缩过的文件和没压缩过的文件,代码结构不同,不能使用同一种处理方法。 ####wrapJsInHtml 解释:是否对html中的js代码添加闭包代码 类型:boolean 默认值:false 说明:如果代码中的require参与运算的话,就忽略该值,为代码加上闭包。 ####tmpl 解释:css和js的引入模板
FAQs
This package is no longer supported and has been deprecated. To avoid malicious use, npm is hanging on to the package name.
The npm package jsm2c receives a total of 0 weekly downloads. As such, jsm2c popularity was classified as not popular.
We found that jsm2c demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.