Research
Security News
Quasar RAT Disguised as an npm Package for Detecting Vulnerabilities in Ethereum Smart Contracts
Socket researchers uncover a malicious npm package posing as a tool for detecting vulnerabilities in Etherium smart contracts.
OneJS is a command-line utility for converting CommonJS packages to single, stand-alone JavaScript files that can be run on web browsers.
$ npm install one
OneJS walks the modules and dependencies defined by package.json files. To create your bundle, just go a project directory and type onejs build
command:
$ onejs build package.json bundle.js
The output OneJS generates can be used by NodeJS, too. It's the easiest way of making sure if the output works or not.
> var exampleProject = require('./bundle');
> exampleProject.main() // calls main module, returns its exports
> exampleProject.require('./b') // each package object has a require method available for external calls
In the case what you need is to try it in web browsers, onejs has a "server" option that'll publish the source code at localhost:1338
let you debug the output with Firebug Lite easily;
$ ../bin/onejs server example-project/package.json
Many modules of the core NodeJS library is able to be used by web projects, as well. OneJS has an 'install' command that converts demanded remote NodeJS module to a package on the fly:
> onejs install assert path url
The reference of available modules that you can install: https://github.com/azer/onejs/blob/master/lib/install_dict.js
OneJS includes a simple emulation of NodeJS' process. (Pass --noprocess if you don't need it)
> exampleProject.require('dependency'), exampleProject.require('./b');
> exampleProject.lib.process.stdout.write("Hello World");
> exampleProject.stdout();
"Hello World"
node_modules/
properly.onejs build package.json --verbose
projectName.map
object if it contains the missing dependencyFAQs
One is a new React Framework that makes Vite serve both native and web.
The npm package one receives a total of 1,299 weekly downloads. As such, one popularity was classified as popular.
We found that one demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket researchers uncover a malicious npm package posing as a tool for detecting vulnerabilities in Etherium smart contracts.
Security News
Research
A supply chain attack on Rspack's npm packages injected cryptomining malware, potentially impacting thousands of developers.
Research
Security News
Socket researchers discovered a malware campaign on npm delivering the Skuld infostealer via typosquatted packages, exposing sensitive data.