
Research
/Security News
Intercom’s npm Package Compromised in Ongoing Mini Shai-Hulud Worm Attack
Compromised intercom-client@7.0.4 npm package is tied to the ongoing Mini Shai-Hulud worm attack targeting developer and CI/CD secrets.
Create, read and edit .zip files with Javascript, with sync capabilities, forked from http://stuartk.com/jszip
A library for creating, reading and editing .zip files with JavaScript, with a lovely and simple API.
This page is the only documentation for JSZip-sync (and JSZip-sync only). See https://stuk.github.io/jszip for the complete JSZip documentation.
JSZip-sync adds sync support to the official JSZip which only supports async methods. Async methods are the recommended way to go when running in a browser UI, where latency is a concern. However, sync methods can also be useful when dealing with complex business logic and executing in node.js or in a worker. It is discouraged to use sync methods in the browser UI.
Sync support is enabled by simply wrapping async calls in zip.sync, as follows:
var JSZip = require("jszip-sync");
var zip = new JSZip();
var zipped = zip.sync(function() {
// put some stuff in there
zip.file("Hello.txt", "Hello World\n");
var img = zip.folder("images");
img.file("smile.gif", imgData, {base64: true});
// call regular async methods
var data = null;
zip.generateAsync({type: "arraybuffer", compression: "DEFLATE"})
.then(function(content) {
data = content;
});
return data;
});
// now zipped contains zipped data
JSZip-sync is dual-licensed. You may use it under the MIT license or the GPLv3 license. See LICENSE.markdown.
FAQs
Create, read and edit .zip files with Javascript, with sync capabilities, forked from http://stuartk.com/jszip
The npm package jszip-sync receives a total of 14,397 weekly downloads. As such, jszip-sync popularity was classified as popular.
We found that jszip-sync demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Compromised intercom-client@7.0.4 npm package is tied to the ongoing Mini Shai-Hulud worm attack targeting developer and CI/CD secrets.

Research
Socket detected a malicious supply chain attack on PyPI package lightning versions 2.6.2 and 2.6.3, which execute credential-stealing malware on import.

Research
A brand-squatted TanStack npm package used postinstall scripts to steal .env files and exfiltrate developer secrets to an attacker-controlled endpoint.