Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
osascript-tag
Advanced tools
A JavaScript template literal tag that executes OSA scripts (AppleScript, JavaScript, etc.)
A JavaScript template literal tag that executes AppleScript and other OSA (Open Scripting Architecture) scripts.
Compatible with JXA (JavaScript for Automation).
Every time I get a script it's a matter of trying to know what I could do with it. I see colors, imagery. It has to have a smell. It's like falling in love. You can't give a reason why.
— Paul Newman
To get started, add osascript-tag
to your project:
npm i --save osascript-tag
It can be used as template literal tag to asynchronously run an AppleScript within your code. It returns a promise that resolves with the output of the script, and rejects with an error if running the script was not successful.
const osascript = require('osascript-tag');
async function main() {
const result = await osascript`
tell application "iTunes"
get { artist, name } of current track
end tell
`;
console.log(result); // "King Gizzard & The Lizard Wizard, This Thing"
}
To run a JXA (JavaScript for Automation) script, use the osascript.jxa
template tag (also available as the named export: jxa
) . Please note that osascript.jxa
requires macOS 10.10 or greater.
const osascript = require('osascript-tag');
async function main() {
await osascript.jxa`
const app = Application.currentApplication();
app.includeStandardAdditions = true;
app.displayNotification("All graphics have been converted.", {
withTitle: "My Graphic Processing Script",
subtitle: "Processing is complete.",
soundName: "Glass",
});
`;
}
By default all calls to osascript.jxa
will resolve with the stdout result as a string.
If your script, however, is expected to return parsable values, you can pass a parse
option to osascript.jxa
to return parsed values ready for consumption in your JavaScript code.
const osascript = require('osascript-tag');
async function main() {
const { artist, title } = await osascript.jxa({ parse: true })`
const iTunes = Application('iTunes');
return {
artist: iTunes.currentTrack.artist(),
title: iTunes.currentTrack.name(),
}
`;
console.log(artist); // "King Gizzard & The Lizard Wizard"
console.log(title); // "This Thing"
}
The osascript-tag
can be used in one of the following ways:
osascript
Executes the given OSA script.
const result = await osascript`
tell application "Finder"
name of every file of the desktop
end tell
`;
script: string
- A string repressing the AppleScript code to execute...replacements: any[]
- The replacements valuesA Promise
that resolves with the script's standard output, or rejects with an error if the scripts was not successful.
osascript(options: Options)
Executes the given OSA script with custom options.
const result = await osascript({ flags: 'so' })`
tell application "Finder"
name of every file of the desktop
end tell
`;
options: Options
- An object with the following keys:
flags?: string
- The flags used to modify the output of the script. It is a string consisting of any of the of the modifier characters e
, h
, o
, and s
. Defaults to "eh"
. The meanings of the modifier characters are as follows:
h
Return values in human-readable form (default).s
Return values in recompilable source form.e
Redirect script errors to stderr (default)o
Redirect script errors to stdout.language?: string
- The language of the OSA script to be executed. Defaults to "AppleScript"
.An instance of osascript
configured with the provided options.
osascript.jxa
A convenient wrapper for osascript
configured to run JXA.
await osascript.jxa`
const app = Application.currentApplication();
app.includeStandardAdditions = true;
app.displayAlert('This is a message');
`;
An instance of osascript
configured to run JXA.
osascript.jxa(options: JXAOptions)
Executes a JXA script with custom options.
const result = await osascript.jxa({ parse: true })`
const app = Application('iTunes');
return {
artist: app.currentTrack.artist(),
title: app.currentTrack.name(),
};
`;
options: JXAOptions
- An object with the following keys:
flags?: string
- The flags used to modify the output of the script. It is a string consisting of any of the of the modifier characters e
, h
, o
, and s
. Defaults to "eh"
. The meanings of the modifier characters are as follows:
h
Return values in human-readable form (default).s
Return values in recompilable source form.e
Redirect script errors to stderr (default)o
Redirect script errors to stdout.parse?: boolean
- A boolean indicating whether the standard output of the script is parsed for consumption in JavaScript. This uses JSON.parse
under the hood. Note that setting this option to true will automatically set the flags
option to "se"
if not set explicitly otherwise. Defaults to false
.argv?: any[]
- An array of arguments to be passed to the script. This array will be available in the JXA script itself as a global variable argv
. Please note that all values will be serialized to strings.An instance of osascript
configured to run JXA with custom options.
MIT
FAQs
A JavaScript template literal tag that executes OSA scripts (AppleScript, JavaScript, etc.)
The npm package osascript-tag receives a total of 9 weekly downloads. As such, osascript-tag popularity was classified as not popular.
We found that osascript-tag demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.