Research
Security News
Malicious npm Package Targets Solana Developers and Hijacks Funds
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
Modjulie is a server for building a library dynamically where required parts are added in the path and query string params of a http request.
It is heavily inspired by the work done by the financial times polyfill io service
npm i modjulie --save
In order to get something serving you can use the example folder structure that has been set up and familiarise yourself with where everything goes before customising.
First create a symlink in your project directory to the example server folders
ln -s node_modules/modjulie/example/ ./example
create your server file
//index.js
const Modjulie = require( 'modjulie' );
const server = new Modjulie();
server.serve();
then run node index.js
and you can access http://localhost:3000/v1/default?modules=moduleC
to see the generated output
you can also take a look at example.index.html
for how it is called from a script url in a page
Modjulie defines a folderstructure as follows
versionsDirectory
├── v1
│ ├── headers (defaultHeaderSources)
│ │ ├── loader.json
│ │ └── namespace.js
│ ├── modules (moduleSourcesDirectory)
│ │ ├── moduleA
│ │ │ └── module.js
│ │ ├── moduleB
│ │ │ └── module.js
│ │ └── moduleC
│ │ └── module.js
│ └── presets (presetConfigurationDirectory)
│ └── default.json
This directory contains files that are added to the library regardless of other config at all times, use this to set up namespaces or do other base configuration
The modules directory contains folders with a module name and a module.js file within that contains the module code
presets define sets of modules that can be aliased to a name
these folders relate to the url structure as follows
/:version/:preset?modules=moduleA
where version is mandatory but the preset is optional
for example
/v1/default?modules=moduleA
The preset (presetConfigurationDirectory) json files each define a json array of module names that should be included as part of the package when the preset is used, for example;
[ "moduleA", "moduleB" ]
The headers (defaultHeaderSources) loader.json file works in a similar way but allows you to define the load order of your headers
[ "namespace.js", "init.js" ]
FAQs
api for dynamic library generation
We found that modjulie demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
Security News
Research
Socket researchers have discovered malicious npm packages targeting crypto developers, stealing credentials and wallet data using spyware delivered through typosquats of popular cryptographic libraries.
Security News
Socket's package search now displays weekly downloads for npm packages, helping developers quickly assess popularity and make more informed decisions.