Research
Security News
Quasar RAT Disguised as an npm Package for Detecting Vulnerabilities in Ethereum Smart Contracts
Socket researchers uncover a malicious npm package posing as a tool for detecting vulnerabilities in Etherium smart contracts.
lodash-finder
Advanced tools
An NPM module which searches for [Lodash][lodash]/[Underscore][underscore] methods used in your source.
An NPM module which searches for Lodash/Underscore methods used in your source.
You might want to use this to create custom Lodash builds, using its include
flag without having to maintain the list of used functions manually.
lodash --include=all,the,functions,you,are,using
The node module provides two functions:
lodashFinder = require('lodash-finder');
functionsUsed = lodashFinder(sourceOfFile);
// functionsUsed == ['each', 'map', 'template']
buildCommand = lodashFinder.getBuildCmd(sourceOfFile, ['modern', '--output', 'lodash.js']);
// buildCommand == 'lodash include=each,map,template modern --output lodash.js'
Additionally, there's an executable which essentially wraps lodash's cli, but passes on the methods to include.
$ lodash-finder src modern --output lodash.js
The command line tool accepts the exact same arguments as lodash's cli, with two differences. The first argument must be a path identifier to find the source files. Paths can be excluded from the source by passing any number of --exclude=
arguments.
Paths can be identified in three ways:
src/**/*.js
test
, which is then translated to test/**/*.js
src/all.js
For example, to include the src
directory but ignore vendor and test files:
$ lodash-finder src --exclude=src/test --exclude=src/vendor
FAQs
An NPM module which searches for [Lodash][lodash]/[Underscore][underscore] methods used in your source.
We found that lodash-finder demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket researchers uncover a malicious npm package posing as a tool for detecting vulnerabilities in Etherium smart contracts.
Security News
Research
A supply chain attack on Rspack's npm packages injected cryptomining malware, potentially impacting thousands of developers.
Research
Security News
Socket researchers discovered a malware campaign on npm delivering the Skuld infostealer via typosquatted packages, exposing sensitive data.