
Research
Namastex.ai npm Packages Hit with TeamPCP-Style CanisterWorm Malware
Malicious Namastex.ai npm packages appear to replicate TeamPCP-style Canister Worm tradecraft, including exfiltration and self-propagation.
Naan.js is a library that provides a set of useful functions for creating partially applied functions. It was originally created to work with node.js but also works in the browser, so long as you have also included the async module.
The best way to understand what naan does is to see it in action:
var statFoo = naan.curry(fs.stat, 'foo.txt');
statFoo(function(err, data) {
// stat result from foo
});
var renameToFoo = naan.positionCurry(fs.rename, fs.rename, 'foo.txt', 1);
renameToFoo('bar.txt', function(err) {
// 'bar.txt' has been renamed to 'foo.txt'
})
var readFooContents = naan.curry(fs.readFile, 'foo.txt');
var writeFooContents = naan.cook(fs.writeFile, readFooContents, 1);
writeFooContents('bar.txt', function(err) {
// The contents of 'foo.txt' has been written to 'bar.txt'
})
// Naan works great with Async!
var readers = ['foo.txt', 'bar.txt', 'bob.txt'].map(function(file) {
return naan.curry(fs.readFile)
});
async.parallel(readers, function(err, contents) {
// contents == contents of foo.txt, bar.txt & bob.txt
});
These are a few of the basic uses of Naan. Each of the available functions are listed below.
For node, just use npm:
npm install naan
Tested in IE9+. It currently uses some ES5 stuff which doesn't work in IE8, but this will be fixed shortly.
For info on how to test in the browser, see testing.
<script src="async.min.js"></script>
<script src="naan.min.js"></script>
<script>
var createDiv = naan.curry(document.createElement, 'div');
</script>
Development: naan.js - 9.5kb Uncompressed
Production: naan.min.js - 3.0kb Minified
FAQs
async and flexible currying for js
The npm package naan receives a total of 104 weekly downloads. As such, naan popularity was classified as not popular.
We found that naan demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Malicious Namastex.ai npm packages appear to replicate TeamPCP-style Canister Worm tradecraft, including exfiltration and self-propagation.

Product
Explore exportable charts for vulnerabilities, dependencies, and usage with Reports, Socket’s new extensible reporting framework.

Product
Socket for Jira lets teams turn alerts into Jira tickets with manual creation, automated ticketing rules, and two-way sync.