
Research
/Security News
9 Malicious NuGet Packages Deliver Time-Delayed Destructive Payloads
Socket researchers discovered nine malicious NuGet packages that use time-delayed payloads to crash applications and corrupt industrial control systems.
An implementation of the monotone framework for JavaScript
npm install monotone --save
import { monotone, runString, Direction, TransferResult } from "monotone";
const instance = monotone((files, checker) => {
return {
direction: Direction.Backward, // Or Direction.Forward
bottom: undefined, // Bottom value
entry() {
return undefined; // Initial value for entry points
},
union(a, b) {
return undefined; // Combine two values
},
isLessOrEqual(a, b) {
return true; // Compare two value
},
kinds: [GraphNodeKind.Begin], // The positions of nodes in the AST that have a transfer function
filter(node) {
return true; // Filter nodes that have a transfer function
}
transfer(node, kind, state, get) {
return TransferResult(state); // The transfer function of the monotone framework
},
result(get) {
return undefined; // Extract the information from the final state
}
};
});
const result = runString(instance, `function(a, b) { return a + b }`);
You can find a complete example, which implements live variable analysis, in src/test/monotone-example.ts.
This project uses the TypeScript compiler for parsing and scope analysis, which can parse both JavaScript and TypeScript.
You can build this project with npm run build and test it with npm test.
Monotone is licensed under the MIT license.
FAQs
An implementation of the monotone framework for JavaScript
The npm package monotone receives a total of 3 weekly downloads. As such, monotone popularity was classified as not popular.
We found that monotone demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Socket researchers discovered nine malicious NuGet packages that use time-delayed payloads to crash applications and corrupt industrial control systems.

Security News
Socket CTO Ahmad Nassri discusses why supply chain attacks now target developer machines and what AI means for the future of enterprise security.

Security News
Learn the essential steps every developer should take to stay secure on npm and reduce exposure to supply chain attacks.