
Research
Malicious npm Package Brand-Squats TanStack to Exfiltrate Environment Variables
A brand-squatted TanStack npm package used postinstall scripts to steal .env files and exfiltrate developer secrets to an attacker-controlled endpoint.
optional-require
Advanced tools
NodeJS Require that let you handle module not found error without try/catch
node.js require that let you handle module not found error without try/catch. Allows you to gracefully require a module only if it exists and contains no error.
So why not just do:
let some;
try {
some = require("some-optional-module");
} catch {
// do nothing
}
let some before try/catch"some-optional-module" contains error itself, above code will silently ignore it, leaving you, and more importantly, your users, puzzling on why it's not working.TypeScript:
import { optionalRequire } from "optional-require";
const some = optionalRequire("some-optional-module");
JavaScript:
const { optionalRequire } = require("optional-require");
const foo = optionalRequire("foo") || {};
const bar = optionalRequire("bar", true); // true enables console.log a message when not found
const xyz = optionalRequire("xyz", "test"); // "test" enables console.log a message with "test" added.
const fbPath = optionalRequire.resolve("foo", "foo doesn't exist");
// relative module path works - *but* you need to pass in `require` from your file
const rel = optionalRequire("../foo/bar", { require });
requireThe default optionalRequire uses require from the context of this module. While you can pass in your require in options, if you want to create your own function that's bound to your require, you can do it with makeOptionalRequire:
import { makeOptionalRequire } from "optional-require";
const optionalRequire = makeOptionalRequire(require);
// now you can optional require files in same dir as your file
const myModule = optionalRequire("./my-module");
In older versions, this module exports makeOptionalRequire directly and this is the legacy usage in JavaScript, which is still supported:
const optionalRequire = require("optional-require")(require);
const foo = optionalRequire("foo") || {};
const bar = optionalRequire("bar", true); // true enables console.log a message when not found
const xyz = optionalRequire("xyz", "test"); // "test" enables console.log a message with "test" added.
const fbPath = optionalRequire.resolve("foo", "foo doesn't exist");
const rel = optionalRequire("../foo/bar"); // relative module path works
https://jchip.github.io/optional-require/modules.html#optionalrequire
Apache-2.0 © Joel Chen
The 'require-optional' package provides similar functionality by allowing you to require modules that may not be installed. It also returns null if the module is not available, but it does not provide options for default values or custom logging messages.
The 'try-require' package attempts to require a module and returns undefined if the module is not found. It is similar to 'optional-require' but does not offer as many customization options such as default values or custom messages.
FAQs
NodeJS Require that let you handle module not found error without try/catch
The npm package optional-require receives a total of 875,130 weekly downloads. As such, optional-require popularity was classified as popular.
We found that optional-require demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A brand-squatted TanStack npm package used postinstall scripts to steal .env files and exfiltrate developer secrets to an attacker-controlled endpoint.

Research
Compromised SAP CAP npm packages download and execute unverified binaries, creating urgent supply chain risk for affected developers and CI/CD environments.

Company News
Socket has acquired Secure Annex to expand extension security across browsers, IDEs, and AI tools.