Research
Security News
Kill Switch Hidden in npm Packages Typosquatting Chalk and Chokidar
Socket researchers found several malicious npm packages typosquatting Chalk and Chokidar, targeting Node.js developers with kill switches and data theft.
path-loader
Advanced tools
Utility that provides a single API for loading the content of a path/URL.
The path-loader npm package is designed to load resources from various paths, including local file paths, URLs, and more. It provides a unified way to fetch and load data from different sources, making it easier to handle resource loading in a consistent manner.
Load from Local File System
This feature allows you to load a resource from the local file system. The code sample demonstrates how to load a JSON file from a specified local path and handle the loaded data or any errors that occur.
const PathLoader = require('path-loader');
PathLoader.load('/path/to/local/file.json')
.then(data => {
console.log(data);
})
.catch(err => {
console.error(err);
});
Load from URL
This feature allows you to load a resource from a URL. The code sample demonstrates how to load a JSON file from a specified URL and handle the loaded data or any errors that occur.
const PathLoader = require('path-loader');
PathLoader.load('https://example.com/data.json')
.then(data => {
console.log(data);
})
.catch(err => {
console.error(err);
});
Load from Multiple Sources
This feature allows you to load resources from multiple sources simultaneously. The code sample demonstrates how to load JSON files from both local paths and URLs, and handle the loaded data or any errors that occur.
const PathLoader = require('path-loader');
const paths = ['/path/to/local/file.json', 'https://example.com/data.json'];
Promise.all(paths.map(path => PathLoader.load(path)))
.then(results => {
results.forEach(data => console.log(data));
})
.catch(err => {
console.error(err);
});
Axios is a popular promise-based HTTP client for the browser and Node.js. It can be used to make HTTP requests to fetch data from URLs, similar to the URL loading feature of path-loader. However, axios does not natively support loading from the local file system.
fs-extra is a module that extends the native Node.js file system module (fs) with additional methods. It can be used to read files from the local file system, similar to the local file loading feature of path-loader. However, fs-extra does not support loading resources from URLs.
node-fetch is a lightweight module that brings window.fetch to Node.js. It can be used to make HTTP requests to fetch data from URLs, similar to the URL loading feature of path-loader. Like axios, node-fetch does not natively support loading from the local file system.
Utility that provides a single API for loading the content of a path/URL. This module works in the browser and in io.js/Node.js. Right now this module supports the following loaders:
http:
or https:
file
loader in the browser is to attempt to load a file using
the URL-version of its location. (Example: file:///Users/not-you/projects/path-loader/package.json
))In the future, there will likely be a pluggable infrastructure for altering this list or overriding the loaders provided by the project but for now that is not an option.
path-loader is available for both Node.js and the browser. Installation instructions for each environment are below.
path-loader binaries for the browser are available in the dist/
directory:
Installation for Node.js applications can be done via NPM.
npm install path-loader --save
The documentation for this project can be found here: https://github.com/whitlockjc/path-loader/blob/master/docs/README.md
The path-loader project's API documentation can be found here: https://github.com/whitlockjc/path-loader/blob/master/docs/API.md
Below is the list of projects being used by path-loader and the purpose(s) they are used for:
FAQs
Utility that provides a single API for loading the content of a path/URL.
We found that path-loader demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket researchers found several malicious npm packages typosquatting Chalk and Chokidar, targeting Node.js developers with kill switches and data theft.
Security News
pnpm 10 blocks lifecycle scripts by default to improve security, addressing supply chain attack risks but sparking debate over compatibility and workflow changes.
Product
Socket now supports uv.lock files to ensure consistent, secure dependency resolution for Python projects and enhance supply chain security.