
Research
/Security News
Malicious npm Packages Target WhatsApp Developers with Remote Kill Switch
Two npm packages masquerading as WhatsApp developer libraries include a kill switch that deletes all files if the phone number isn’t whitelisted.
Larry is a generic packaging tool for applications that need to bundle their source code in packages, ready to be shipped.
Usage: larry [options]
Parameter | Description |
---|---|
-h, --help | Output usage information |
-V, --version | Output the version number |
-c, --config [path] | Path to JSON configuration file. Default './larry.json' in the current directory. |
`-q, --quiet | Let not Larry chatter while he does his job. |
Configuration of Larry has three main parts - options, components and packages. These configurations need to be put in a JSON file, which is passed to the larry
executible with the --config
option. A sample configuration file can be seen at tests/fixtures/config/larry.json
.
These are general options for Larry, the options
object can contain:
Key | Description |
---|---|
input | Base input directory (required). |
output | Base output directory (required). |
archive | Whether to turn on archiving for all packages. Default true . |
A sample options
object will look like:
{
"options": {
"input" : "./src/artefacts",
"output" : "./out",
"archive" : true
}
}
A component definition contains all the component properties that would be needed while packaging. components
in the configuration will be an array of objects where each item in the array will define a new component. A component can be used by multiple packages.
Each item in the components
array can contain:
Key | Description |
---|---|
name | Name of the component. |
description | A description of the component. |
include | An array of paths to be included, relative to options.input . |
destination | An array of destination paths corresponding to items in include . |
excludePattern | A regex string. Files matching this regex string will be excluded. |
enabled | If false , disables the component. Default true . |
A sample components
object will look like:
{
"components": [
{
"name": "component-1",
"include": [
"node_modules/",
"src"
],
"destination": [
"bin/ok",
"files/src"
],
"excludePattern": ".*\\.json"
},
{
"name": "component-2",
"include": [
"node_modules/",
"src"
],
"destination": [
"bin2/ok",
"files2/src"
]
}
]
}
A package definition contains a list of all components that will be part of the package. Similar to components
, packages
option will be an array of objects, where each item will define a new package.
Each item in the packages
array can contain:
Key | Description |
---|---|
name | Name of the package. |
description | Description of the component. |
components | An array of component names to include in this package. |
archive | Whether to archive the package or not. Overrides options.archive . |
archiveRoot | If archive is true , this is the name of the root folder within the archive. |
A sample packages
object will look like:
{
"packages": [
{
"name": "p1",
"enabled": true,
"components": [
"component-1"
],
"archiveRoot": "package1",
"archive": true
},
{
"name": "p2",
"enabled": true,
"components": [
"component-1",
"component-2"
],
"archive": false
}
]
}
includePattern
in components.FAQs
A packaging tool for bundling project releases
The npm package larry receives a total of 1 weekly downloads. As such, larry popularity was classified as not popular.
We found that larry demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 3 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
Two npm packages masquerading as WhatsApp developer libraries include a kill switch that deletes all files if the phone number isn’t whitelisted.
Research
/Security News
Socket uncovered 11 malicious Go packages using obfuscated loaders to fetch and execute second-stage payloads via C2 domains.
Security News
TC39 advances 11 JavaScript proposals, with two moving to Stage 4, bringing better math, binary APIs, and more features one step closer to the ECMAScript spec.