Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
A Node JS wrapper around commander to allow for easy commandline and env var parsing
Opter provides an easy way to specify options for your application. It uses commander to parse command line arguments and display option help information. In addition to reading from command line options, it can also read values from environment variables and a json/yaml file (opter.json) that lives in the same directory as the file being run by NodeJS. If no values were found in the command line arguments, environment variables, or the JSON/YAML config file, then it will assign the default value (if provided). The priority is:
This module makes use of a Makefile
for building/testing purposes. After obtaining a copy of the repo, run the following commands to make sure everything is in working condition before you start your work:
make install
make test
Before committing a change to your fork/branch, run the following commands to make sure nothing is broken:
make test
make test-cov
Don't forget to bump the version in the package.json
using the semver spec as a guide for which part to bump. Submit a pull request when your work is complete.
Notes:
npm install opter
The opter function takes three parameters:
require('./package.json').version
)opter.json
. All relative paths are assumed to be relative the file being executed by Node.The object containing the options should be formatted like so:
{
myOption: { // correlates to command line option "--my-option" and environment variable "myOption" and environment variable "MYOPTION" and opter.json property "myOption"
character: 'm', // optional, used as the short option for the command line. If not provided opter will try to pick one for you based on your option name.
argument: 'string', // optional, describes what the value should be. If not provided, it defaults to the "type" within the schema if set, otherwise to "string". If the schema type is "boolean", no argument is required.
defaultValue: 'fnord', // optional, the value to set the option to if it wasn't specified in the args or env vars
required: true, // optional, if set to true and no value is found, opter will throw an error. defaults to false.
schema: { // optional, a JSONSchema definition to validate the value against. If the "type" property is used, opter will also try to convert the value to that type before validating it.
type: 'string', // optional, the type that the value should conform to
description: '' // optional, describes the option and is used when generating the command line help
}
}
}
Note: If argument
is missing or falsey and type
is not Boolean
, an error will be thrown.
The function returns an object containing the keys that were specified in the options that were passed along with the values that opter found from the args, env vars, or default values. For example, calling the opter function with the above sample options object, the result might look like:
{
myOption: 'fnord'
}
Here is an example on how to use opter:
// app.js
var opter = require('opter'),
appVersion = require('./package.json').version,
opts = {
myOption: {}
},
options = opter(opts, appVersion);
With the example above, here are some sample ways to invoke the app:
$ node app.js -m test
$ node app.js --my-option test
$ export myOption=test && node app.js
$ node app.js -h
$ node app.js -V
When an app using opter is run with the "-h" option, something similar will be displayed in the console:
$ node app.js -h
Usage: app.js [options]
Options:
-h, --help output usage information
-V, --version output the version number
-m, --my-option <value> (Optional) Enables some cool funcitonality. Defaults to: true
Here is an example opter.json file:
{
"myOption": "fnord"
}
You can also specify option names with dots (.) to denote a nested property within your opter.json
file. However, when using dots in the name, the environment variable will have the dots replaced with underscores (_). Here is an example:
Opter options:
{
'statsd.host': {
character: 's',
argument: 'host',
defaultValue: 'localhost:8125'
},
'statsd.prefix': {
chatacter: 'S',
argument: 'string'
}
};
Corresponding commandline arguments:
... --statsd.host=localhost:8125 --statsd.prefix=myApp
Corresponding environment variables:
statsd_host=localhost:8125
statsd_prefix=myApp
Corresponding opter.json:
{
statsd: {
host: 'localhost:8125',
prefix: 'myApp'
}
}
The object returned by the opter function:
{
statsd: {
host: 'localhost:8125',
prefix: 'myApp'
}
}
As you can see, the object returned by opter will look identical to what you put in the opter.json
file, as long as ll the properties in the opter.json file match the configuration options passed to the opter method.
The MIT License (MIT) Copyright (c) 2013 Mac Angell
Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
FAQs
A Node JS wrapper around commander to allow for easy commandline and env var parsing
The npm package opter receives a total of 10,930 weekly downloads. As such, opter popularity was classified as popular.
We found that opter demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.