
Research
PyPI Package Disguised as Instagram Growth Tool Harvests User Credentials
A deceptive PyPI package posing as an Instagram growth tool collects user credentials and sends them to third-party bot services.
kor is a JavaScript library supporting reactive programming. It is actually just a tiny subset of the excellent Knockout library with all the stuff to do with binding to the DOM removed. This is because there are several ways to achieve the DOM-binding part (for example, React) but which lack anything as mature or helpful as Knockout's reactive programming support.
By cutting Knockout down to its core (or kor?) we end up with a library that is only 5.4 KB in size (minified+gzipped) and yet supplies the support needed for convenient reactive programming.
Given kor's obvious direct heritage, it would be ridiculous for me to claim authorship - I just deleted a bunch of stuff. At the same time the Knockout team have not decided to create this subset so they should not be blamed for any shortcomings it suffers from.
Therefore to give credit and blame where its due, let's say:
Copyright (c) Steven Sanderson, the Knockout.js team, and other contributors http://knockoutjs.com/, with parts deleted by Daniel Earwicker
MIT license - http://www.opensource.org/licenses/mit-license.php
The surviving functions work exactly the same as in Knockout. The only
difference is that when loaded by a script tag in the browser, the root object
is called kor
instead of ko
, to avoid collision with Knockout:
kor.observable
kor.observableArray
kor.computed
and kor.pureComputed
(prefer the latter)kor.extenders
and built-ins such as throttle
, rateLimit
kor.unwrap
and kor.peekObservable
kor.toJS
As a bonus, I've also integrated the knockout.clear extension that I put together with a lot of help from Michael Best of the Knockout team, so that includes:
kor.unpromise
kor.execute
You can find complete documentation for all these features in their respective source libraries:
There are extension libraries that work alongside Knockout, such as Mapping
In the browser, if you are just using a script
tag to import kor, you would
need to "rename" kor by doing this before you load any extension libraries:
window.ko = window.kor;
Of course, this is only useful if the extension library is satisfied by the subset retained in kor.
(NB. I'm planning to fix knockout.clear so it automatically works with kor).
There are type declarations in the typings
folder.
FAQs
A tiny subset of Knockout for reactive programming
The npm package kor receives a total of 15 weekly downloads. As such, kor popularity was classified as not popular.
We found that kor demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
A deceptive PyPI package posing as an Instagram growth tool collects user credentials and sends them to third-party bot services.
Product
Socket now supports pylock.toml, enabling secure, reproducible Python builds with advanced scanning and full alignment with PEP 751's new standard.
Security News
Research
Socket uncovered two npm packages that register hidden HTTP endpoints to delete all files on command.