Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
generic util lib -> js obj/ str utils, fs utils, rest utils, web utils, ...
common utility methods
https://github.com/substack/minimist
parse argument options
This module is the guts of optimist's argument parser without all the fanciful decoration.
var argv = require('minimist')(process.argv.slice(2));
console.dir(argv);
$ node example/parse.js -a beep -b boop
{ _: [], a: 'beep', b: 'boop' }
$ node example/parse.js -x 3 -y 4 -n5 -abc --beep=boop foo bar baz
{ _: [ 'foo', 'bar', 'baz' ],
x: 3,
y: 4,
n: 5,
a: true,
b: true,
c: true,
beep: 'boop' }
var parseArgs = require('minimist')
Return an argument object argv
populated with the array arguments from args
.
argv._
contains all the arguments that didn't have an option associated with
them.
Numeric-looking arguments will be returned as numbers unless opts.string
or
opts.boolean
is set for that argument name.
Any arguments after '--'
will not be parsed and will end up in argv._
.
options can be:
opts.string
- a string or array of strings argument names to always treat as
strings
opts.boolean
- a boolean, string or array of strings to always treat as
booleans. if true
will treat all double hyphenated arguments without equal signs
as boolean (e.g. affects --foo
, not -f
or --foo=bar
)
opts.alias
- an object mapping string names to strings or arrays of string
argument names to use as aliases
opts.default
- an object mapping string argument names to default values
opts.stopEarly
- when true, populate argv._
with everything after the
first non-option
opts['--']
- when true, populate argv._
with everything before the --
and argv['--']
with everything after the --
. Here's an example:
> require('./')('one two three -- four five --six'.split(' '), { '--': true })
{ _: [ 'one', 'two', 'three' ],
'--': [ 'four', 'five', '--six' ] }
Note that with opts['--']
set, parsing for arguments still stops after the
--
.
opts.unknown
- a function which is invoked with a command line parameter not
defined in the opts
configuration object. If the function returns false
, the
unknown option is not added to argv
.
advanced logging using DEBUG env var with advanced typed formating, fs output, middleware mappings, and color mappings
set NODE_ENV=development && set DEBUG="api:twitter"
First, setup your environment variables, NODE_ENV and DEBUG.
The NODE_ENV environment var specifies your runtime nodejs env and is used by several npm modules to alter configuration. For example, the 'express' server module changes caching and all sorts of optimations based on this value.
Typical values include : "development", "production" Advanced values include : "test", "staging", "local"
If NODE_ENV === "production", NO log messages will leak to output.
DEBUG environment var specifies what keyed log messages are allowed to leak to the output (ie. stdout or log.txt or log.json) The express server module changes caching and all sorts of optimations based on this value.
set NODE_ENV=development
set DEBUG="api:twitter"
or
set NODE_ENV=development && set DEBUG="api:twitter"
NODE_ENV === "production" No logs leak DEBUG=* All logs leak DEBUG=something:blah:* Contains 'something:blah:' logs leak DEBUG=something:blah Equals 'something:blah' logs leak
/**
* File System
*/
/**
* Global Regex
*/
/**
* Alpha Characters
*/
// "white_space": /^\s+/,
// "alpha": /[A-Za-z]/,
// "dots": /\./g,
// "dashes": /^-|-$/g,
// "dash_dot_all": /^--([^=]+)=([\s\S]*)$/,
// "in_parenthesis": /\(([^()]+)\)/g,
// "in_braces": /\{([^}]+)\}/,
// "back_quote": /\"/g,
/**
* Numbers
*/
// "alpha_num": /[^a-z0-9]+/g,
// "num": /^0x[0-9a-f]+$/i,
// "digits": /^[-+]?(?:\d+(?:\.\d*)?|\.\d+)(e[-+]?\d+)?$/,
// "dig": /-?\d+(\.\d*)?(e-?\d+)?$/,
/**
* Boolean
*/
// "bool": /^(true|false)$/,
// "bool_lo": /true|false/,
/**
* Cmd
*/
/*
snapp/lodash - lodash wrapper + js base classes utils (string, object, array, funcitons, dates, etc.)
mod: lodash
info: Lodash modular utilities.
version: 4.13.1
web: https://lodash.com/
git: https://github.com/lodash/lodash
npm: https://www.npmjs.com/package/lodash
mod: numeral
info: A javascript library for formatting and manipulating numbers.
version: 1.5.3
web: http://numeraljs.com/
git: https://github.com/adamwdraper/Numeral-js
npm: https://www.npmjs.com/package/numeral
mod: jquery-deferred
info: jQuery deferred lib for nodeJS.
version: 0.3.0
git: https://github.com/zzdhidden/node-jquery-deferred
npm: https://www.npmjs.com/package/jquery-deferred
mod: moment
info: Parse, validate, manipulate, and display dates in javascript.
version: 2.13.0
web: http://momentjs.com/
git: https://github.com/moment/moment
npm: https://www.npmjs.com/package/moment
mod: backbone -> see snapp/backbone
*/
var path = require('path'),
util = require('util'),
_ = require('lodash'),
Backbone = require('backbone'),
moment = require('moment'),
numeral = require('numeral'),
jsonminify = require('jsonminify'),
beautifyHtml = require('pretty');
// STATIC
var EOL = require('os').EOL,
INFO_DEFAULTS = {
_name: "",
_version: "",
_r: "",
_dirname: "",
_filename: "",
_description: "",
_deps: {},
_devDeps: {},
_package: {},
_has: undefined,
_info: undefined,
_mixins: undefined,
_toFile: undefined,
_toFileData: undefined
},
INFO_KEYS = _.keys(INFO_DEFAULTS),
ERROR_MSG = '---->Default Error Occurred <----';
// REGX CACHE
var REGX_UTF_BOM = /^\uFEFF/,
REGX_COMMAS = /(\d+)(\d{3})/,
REGX_APLHA_NUM = /[^a-z0-9]+/g,
REGX_DASHES = /^-|-$/g,
REGX_BRACES = /{([^{}]*)}/g,
REGX_PARENTHESIS = /[{()}]/g,
REGX_SPECIAL = /[^a-zA-Z0-9-_.]/g,
REGX_SCRIPT = /<script([^'"]|"[^"]*"|'[^']*')*?<\/script>/gi,
REGX_SLASHES = /^\/+|\/+$/g,
REGX_TRAILING_SLASH = /\/+$/,
REGX_PHONE_TRIM = /\D/g,
REGX_US_PHONE = /^(\d{3})(\d{3})(\d{4})$/,
REGX_US_DOLLARS = /(\d)(?=(\d{3})+\.)/g,
REGX_SPACES = /\s+/g,
REGX_RETURNS = /(\r\n|\n|\r)/g,
REGX_LINES = /\r\n|\n\r|\n|\r/g,
REGX_LINES_COMPACT = /[^\r\n]+/g,
REGX_NO_COMMA_SEMI_AT_END = /[,,]$/,
REGX_OPEN_CLOSE = /[\(\)]/g,
REGX_QUERY_OBJECT = /[?&]([^=#]+)=([^&#]*)/g,
//REGX_COMMENTS = /((\/\/.*$)|(\/\*[\s\S]*?\*\/))/mg;
REGX_COMMENTS = /(\/\/.*$)|(\/\*[\s\S]*?\*\/)|(\s*=[^,\)]*(('(?:\\'|[^'\r\n])*')|("(?:\\"|[^"\r\n])*"))|(\s*=[^,\)]*))/mg,
REGX_ARG_NAMES = /([^\s,]+)/g,
REGX_STUFF_IN_PARENTHESES = /\(([^()]+)\)/g,
REGX_BACK_QUOTE = /\"/g;
## snapp
version: 0.0.1
global utils lib required by all other snapp-* libs
snapp nodejs utils lib
### drive
typed file system api
#### drive models
abstract models for reading/writing collections/models to disk (with most file formats)
### pretty
mod: pretty
info: Some tweaks for beautifying HTML with js-beautify
version: 1.0.0
git: https://github.com/jonschlinkert/pretty
npm: https://www.npmjs.com/package/pretty
### stream
request(url)
.on('error', function (err) {
callback(err);
})
.on('response', function (res) {
console.log(res.statusCode) // 200
console.log(res.headers['content-type']) // 'image/png'
callback(null, res);
})
.pipe(disk.createWriteStream(dest));
FAQs
generic util lib -> js obj/ str utils, fs utils, rest utils, web utils, ...
The npm package ninjs-core receives a total of 1 weekly downloads. As such, ninjs-core popularity was classified as not popular.
We found that ninjs-core demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.