
Security News
The Hidden Blast Radius of the Axios Compromise
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.
node-slimer
Advanced tools
It seems like node-phantom is no longer maintained. This is a copy of that project with some fixes. The end result is published on npm as node-slimer.
This is a bridge between PhantomJs and Node.js.
It is very much similar to the other bridge available, PhantomJS-Node, but is different in a few ways:
You will need to install PhantomJS first. The bridge assumes that the "phantomjs" binary is available in the PATH.
The only other dependency for using it is socket.io.
For running the tests you will need Mocha. The tests require PhantomJS 1.6 or newer to pass.
npm install node-slimer
You can use it pretty much like you would use PhantomJS-Node, for example this is an adaptation of a web scraping example :
var phantom=require('node-slimer');
phantom.create(function(err,ph) {
return ph.createPage(function(err,page) {
return page.open("http://tilomitra.com/repository/screenscrape/ajax.html", function(err,status) {
console.log("opened site? ", status);
page.includeJs('http://ajax.googleapis.com/ajax/libs/jquery/1.7.2/jquery.min.js', function(err) {
//jQuery Loaded.
//Wait for a bit for AJAX content to load on the page. Here, we are waiting 5 seconds.
setTimeout(function() {
return page.evaluate(function() {
//Get what you want from the page using jQuery. A good way is to populate an object with all the jQuery commands that you need and then return the object.
var h2Arr = [],
pArr = [];
$('h2').each(function() {
h2Arr.push($(this).html());
});
$('p').each(function() {
pArr.push($(this).html());
});
return {
h2: h2Arr,
p: pArr
};
}, function(err,result) {
console.log(result);
ph.exit();
});
}, 5000);
});
});
});
});
options is an optional object with options for how to start PhantomJS.
options.parameters is an array of parameters that will be passed to PhantomJS on the commandline.
For example
phantom.create(callback,{parameters:{'ignore-ssl-errors':'yes'}})
will start phantom as:
phantomjs --ignore-ssl-errors=yes
You may also pass in a custom path if you need to select a specific instance of PhantomJS or it is not present in PATH environment. This can for example be used together with the PhantomJS package like so:
phantom.create(callback,{phantomPath:require('phantomjs').path})
You can also use slimerJS:
phantom.create(callback,{phantomPath: './slimerjs-0.9.6/slimerjs'})
Once you have the phantom instance you can use it much as you would the real PhantomJS, node-slimer tries to mimic the api.
An exception is that since this is a wrapper that does network communication to control PhantomJS, all methods are asynchronous and with a callback even when the PhantomJS version is synchronous.
Another notable exception is the page.evaluate method (and page.evaluateAsync method) that since PhantomJS 1.6 has a provision for extra arguments to be passed into the evaluated function. In the node-slimer world these arguments are placed after the callback. So the order is evaluatee, callback, optional arguments. In code it looks like :
page.evaluate(function(s){
return document.querySelector(s).innerText;
},function(err,title){
console.log(title);
},'title');
You can also have a look at the test folder to see some examples of using the API.
Made by Alex Scheel Meyer. Released to the public domain.
FAQs
bridge between node.js and PhantomJS | SlimerJS
The npm package node-slimer receives a total of 8 weekly downloads. As such, node-slimer popularity was classified as not popular.
We found that node-slimer demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.