Research
Security News
Quasar RAT Disguised as an npm Package for Detecting Vulnerabilities in Ethereum Smart Contracts
Socket researchers uncover a malicious npm package posing as a tool for detecting vulnerabilities in Etherium smart contracts.
In a nutshell, rewrite (AKA alias, map) `require()` IDs / paths / directories to different values.
This is a browserify plugin that's meant to do the same kind of thing as aliasify and remapify, but in a more elegant, powerful way. This is very experimental right now, a proof of concept. It's only been tested by me so far. If it seems like people are interested I may pursue it further.
In a nutshell, rewrite (AKA alias, map) require()
IDs / paths to different values. E.g. rewrite require('app/model/something')
to a relative path, e.g. ./model/something
. The point is to avoid having to use cumbersome relative paths (e.g. ./
and ../
) throughout your browserified application, and still be able to apply transforms programatically, e.g. browserify().transform(something)
. This can be used to alias entire directories or any specific ID strings passed to require()
, and the rewriting can be dependent on the path of the requiring file as well.
Say you have a directory structure like...
somedir/
+-- src/
+-- entry.js
+-- model/
¦ +-- whatever.js
+-- subdir/
+-- subsubdir/
+-- something.js
something.js
require('app/model/whatever');
...and entry.js
is the entry point to a dependency graph with a bunch of files not pictured and you want to be able to require()
somedir/src/model/whatever.js
or somedir/src/...
from anywhere in the dependency graph without using ./
/ ../
relative paths. You also don't want to store the files or symlink to them under node_modules
because it will break programmatic application of transforms (e.g. browserify('./src/entry').transform(whatever)
). (But, see below -- you can combine this tool with symlinking to get the best of both worlds.)
var
path = require('path'),
pathmodify = require('pathmodify');
var opts = {
// Feel free to think of 'mods' as referring to either modifications or
// module IDs that are being altered.
mods: [
function (rec) {
var alias = {};
var prefix = 'app' + path.sep;
if (rec.id.indexOf(prefix) === 0) {
alias.id = path.join(__dirname, 'src', rec.id.substr(prefix));
}
return alias;
}
]
};
browserify('./src/entry')
.plugin(pathmodify, opts)
The structure of the members of the mods
array is a work in progress. But suffice it to say that for the time being you can pass a function that will receive an object like this:
{
// The string passed to `require()`
id: '...',
opts: {
// Absolute path of the parent file (the one that called require())
filename: '...'
}
}
It should leave the passed object alone and return an object like this if the id
should be aliased to something else:
{
// The path / id that should be resolved (e.g. argument to
// node-browser-resolve)
id: '...',
// Optional name to expose the module as (like
// b.require('x', {expose: 'whatever'}))
expose: '...'
}
If you don't want to alias the id
to something else, return anything else (or nothing).
As alluded to earlier, ordinarily you could store or symlink your application as something like node_modules/app
and require its files from node like require('app/something/whatever')
. But if you do that in browserify you lose the ability to apply transforms like:
browserify('./entry')
.transform(some_transform)
With this plugin you can get the best of both worlds by symlinking your application under node_modules
and get the normal resolution behavior in node, and use the same paths in browserify by rewriting them to absolute paths (outside of node_modules
) or paths relative to the requiring file. So if you have say /somedir/src
synlinked as node_modules/app
, configure this plugin and point browserify at entry files under src
.
FAQs
Rewrite (alias) and expose `require()` IDs in browserify.
The npm package pathmodify receives a total of 481 weekly downloads. As such, pathmodify popularity was classified as not popular.
We found that pathmodify demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket researchers uncover a malicious npm package posing as a tool for detecting vulnerabilities in Etherium smart contracts.
Security News
Research
A supply chain attack on Rspack's npm packages injected cryptomining malware, potentially impacting thousands of developers.
Research
Security News
Socket researchers discovered a malware campaign on npm delivering the Skuld infostealer via typosquatted packages, exposing sensitive data.