
Security News
/Research
Wallet-Draining npm Package Impersonates Nodemailer to Hijack Crypto Transactions
Malicious npm package impersonates Nodemailer and drains wallets by hijacking crypto transactions across multiple blockchains.
locreq
is an answer to the problem of requiring local paths in Node.js. It allows you to easily require modules by specifying their paths relative to your project root, not relative to the file they're require
d from.
Assume the following directory structure:
- lib
- collectionA
- moduleA1.js
- moduleA2.js
- collectionB
- collectionB1
- moduleB1a.js
Now, to require module A2.js
from module B1a.js
, using regular require
:
require("../../collectionA/moduleA2.js");
There are a few problems with the above example:
B1a.js
file, you have to update the argument to require
;A2
module.With locreq
, it's easier:
const locreq = require("locreq")(__dirname);
locreq("lib/collectionA/moduleA2.js");
If you have lots of dependencies, locreq
can really make a difference.
To install locreq
, use:
npm install --save locreq
To use the module, require it like so:
const locreq = require("locreq")(__dirname);
The (__dirname);
part is very important, don't forget it!
Next, simply use locreq
instead of require
for your local modules, giving a path relative to the root of your package (that is, relative to the directory where the package.json
of your project is):
var moduleA = locreq("lib/my-modules/moduleA.js");
Similar to regular require
, you can also use the locreq.resolve
method:
const module_path = locreq.resolve("lib/my-modules/moduleA.js"); //returns the absolute path to the module
locreq
goes up the directory hierarchy, parent directory by parent directorypackage.json
it stops the search and treats the directory as the root directory of the packagerequire
on a path that's resolved from combining the package root directory and the path given as an argument, and then returns that.require
d by a different package (which is not the case for the require.main.require
trick);require
behavior.FAQs
Require local modules without all that '../../../' BS
We found that locreq demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
/Research
Malicious npm package impersonates Nodemailer and drains wallets by hijacking crypto transactions across multiple blockchains.
Security News
This episode explores the hard problem of reachability analysis, from static analysis limits to handling dynamic languages and massive dependency trees.
Security News
/Research
Malicious Nx npm versions stole secrets and wallet info using AI CLI tools; Socket’s AI scanner detected the supply chain attack and flagged the malware.