
Research
Malicious fezbox npm Package Steals Browser Passwords from Cookies via Innovative QR Code Steganographic Technique
A malicious package uses a QR code as steganography in an innovative technique.
lodash-chainer
Advanced tools
Simple chaining of lodash functions. Without requiring the entire lodash package, or lodash/fp.
This allows us to use modular imports, so that we can strip unused lodash code from our bundle.
import split from "lodash/split";
import toUpper from "lodash/toUpper";
import chainer from "lodash-chainer";
let value = "loud noises";
let wordsReversed = chainer(value)
.do(split, " ")
.do(reverse).value; // ['noises', 'loud']
import split from "lodash/split";
import reverse from "lodash/reverse";
import flow from "lodash/flow";
import curryRight from "lodash/curryRight";
import _ from "lodash";
import chainer from "lodash-chainer";
let value = "loud noises";
let upperCasedWords;
// Undesirable as it's not chained
wordsReversed = reverse(split(value, " "));
// Undesirable as `_` relies on importing the entire lodash package
wordsReversed = _(value).split(" ").reverse().value();
// Undesirable as `chain` also relies on importing the entire lodash package - even if used as a relative import
wordsReversed = _.chain(value).split(" ").reverse().value();
// Undesirable as you have to wrap lodash functions in order to pass arguments
wordsReversed = flow(
(innerValue) => split(innerValue, " "),
reverse
)(value);
// Undesirable as you have to wrap lodash functions with curryRight
wordsReversed = flow(
curryRight(split)(" ", 2),
curryRight(reverse)
)(value);
// Undesirable as you have to go all-in on lodash/fp, which some developers prefer not to do
// Mixing lodash with lodash/fp "just for the chaining" is confusing, and results in duplicated code in the bundle
import split from "lodash/fp/split";
import reverse from "lodash/fp/reverse";
import flow from "lodash/fp/flow";
wordsReversed = flow(split(" "), reverse)(value);
// Has a nice interface, but requires the additional step to set plugins every time you use it.
import lodashChain from "lodash-chain";
lodashChain.plugins({ split, reverse });
wordsReversed = lodashChain
.chain(value)
.split(" ")
.reverse()
.value();
expect(wordsReversed).toEqual(["noises", "loud"]);
// Similar to above, undesirable due to having to wrap functions to pass arguments
import { chain } from "@spacet.me/chain";
wordsReversed = chain(value)
.thru((value) => split(value, " "))
.thru(reverse)
.value();
FAQs
A utility for chaining function calls in vanilla lodash
We found that lodash-chainer demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
A malicious package uses a QR code as steganography in an innovative technique.
Research
/Security News
Socket identified 80 fake candidates targeting engineering roles, including suspected North Korean operators, exposing the new reality of hiring as a security function.
Application Security
/Research
/Security News
Socket detected multiple compromised CrowdStrike npm packages, continuing the "Shai-Hulud" supply chain attack that has now impacted nearly 500 packages.