
Security Fundamentals
Turtles, Clams, and Cyber Threat Actors: Shell Usage
The Socket Threat Research Team uncovers how threat actors weaponize shell techniques across npm, PyPI, and Go ecosystems to maintain persistence and exfiltrate data.
load-polyfill
Advanced tools
import 'es6-promise/auto'
loadPolyfill accept an array of two dimesions
in each one item[0] should be boolean or function, when function it should return bool in sync code
in each one item[1] could be string or function, when function it should return promise
it return promise, call your main code in 'then' method
import loadPolyfill from 'load-polyfill'
// here use dynimic import and webpack code spliting feature.
loadPolyfill([
['isArray' in Array, 'core-js/fn/array/is-array'],
// when the second is fn, it must return promise
['isArray' in Array, () => import('lodash/isArray').then(module => Array.isArray = module)],
['from' in Array, 'core-js/fn/array/from'],
[() => 'find' in Array.prototype, 'core-js/fn/array/find'], // will call dynimic import('core-js/fn/array/find')
[() => 'find' in Array.prototype, () => import('core-js/fn/array/find')], // or run your own logic
[() => {
// some code to test env does not have Map
return 'Map' in global
}, () => import('es6-map/polyfill')],
]).then(() => {
// load your main code here
// for example
ReactDom.render(<App />, document.querySelector('#main'))
})
polyfills list have to be maintained manually, depend on your dest browser env.
MIT
FAQs
load your polyfill async only when needed
The npm package load-polyfill receives a total of 2 weekly downloads. As such, load-polyfill popularity was classified as not popular.
We found that load-polyfill demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security Fundamentals
The Socket Threat Research Team uncovers how threat actors weaponize shell techniques across npm, PyPI, and Go ecosystems to maintain persistence and exfiltrate data.
Security News
At VulnCon 2025, NIST scrapped its NVD consortium plans, admitted it can't keep up with CVEs, and outlined automation efforts amid a mounting backlog.
Product
We redesigned our GitHub PR comments to deliver clear, actionable security insights without adding noise to your workflow.