Research
Security News
Quasar RAT Disguised as an npm Package for Detecting Vulnerabilities in Ethereum Smart Contracts
Socket researchers uncover a malicious npm package posing as a tool for detecting vulnerabilities in Etherium smart contracts.
OneJS is a command-line utility for converting CommonJS packages to single, stand-alone JavaScript files that can be run on other JavaScript platforms such as web browsers, unity, silkjs etc.
$ npm install one
It's an easy way to give OneJS a test-drive. Example project is located at this repository;
$ git clone git@github.com:azer/onejs.git
$ cd onejs
$ npm install
$ cd example-project
It's a non-functional NodeJS project with some dummy dependencies under node_modules directory. The built file will contain all the packages under node_modules directory;
$ ../bin/onejs build package.json bundle.js
Now we're willing to test the code OneJS generated for us. Quickest way might be requiring it from NodeJS;
> var exampleProject = require('./bundle');
> exampleProject.main() // calls main module of the package, returns its exports
> exampleProject.require('./b') // each package object has a require method available for external calls
To test it on web browsers, OneJS has a "server" command that builds the source code and start serving it at localhost:1338.
$ ../bin/onejs server example-project/package.json
You can simply go to that URL and inspect the content of "exampleProject" object, using Firebug Lite. The whole source code with dependencies (if exists) is wrapped by it. It also provides an external API for the possible clients, containing some methods such as require, main, stdin, stdout, stderror.
> exampleProject.require('dependency'), exampleProject.require('./b');
> exampleProject.lib.process.stdout.write("Hello World");
> exampleProject.stdout();
"Hello World"
FIXME
FIXME
FAQs
One is a new React Framework that makes Vite serve both native and web.
The npm package one receives a total of 1,299 weekly downloads. As such, one popularity was classified as popular.
We found that one demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket researchers uncover a malicious npm package posing as a tool for detecting vulnerabilities in Etherium smart contracts.
Security News
Research
A supply chain attack on Rspack's npm packages injected cryptomining malware, potentially impacting thousands of developers.
Research
Security News
Socket researchers discovered a malware campaign on npm delivering the Skuld infostealer via typosquatted packages, exposing sensitive data.