Security News
Node.js EOL Versions CVE Dubbed the "Worst CVE of the Year" by Security Experts
Critics call the Node.js EOL CVE a misuse of the system, sparking debate over CVE standards and the growing noise in vulnerability databases.
The pirates npm package is designed to add hooks to Node.js's require function, allowing developers to modify the behavior of module loading. This can be particularly useful for tasks such as compiling code on-the-fly, implementing custom loaders, or applying transformations to module sources before they are executed.
Adding a hook to require
This feature allows you to add a custom transformation hook to Node.js's require function for files with specific extensions. In the code sample, a hook is added for '.js' files, where you can transform the code before it's executed. The `revert` function can be called to remove the hook.
const { addHook } = require('pirates');
const revert = addHook((code, filename) => {
// Transform the code here
return code;
}, {
exts: ['.js']
});
Similar to pirates, @babel/register modifies the Node.js module loading behavior to transpile ES6+ code on-the-fly using Babel. While pirates provides a generic API for hooking into the require function, @babel/register is specifically tailored for Babel transformations.
ts-node is another package that provides functionality similar to pirates but is focused on TypeScript. It allows TypeScript files to be executed and imported directly by patching Node.js's module loading system. Unlike pirates, which is agnostic to the type of transformations applied, ts-node specifically compiles TypeScript to JavaScript.
Two reasons:
super
.For some context, see the Babel issue thread which started this all, then the nyc issue thread, where discussion was moved (as we began to discuss just using the code nyc had developed), and finally to #1 where discussion was finally moved.
npm install --save pirates
Using pirates is really easy:
// my-module/register.js
var pirates = require('pirates');
// Instead of messing with require like this:
var old = require.extensions['.js'];
require.extensions['.js'] = function (mod, filename) {
var compile = mod._compile;
mod._compile = function (code, filename) {
code = myLib.compileFile(code, filename);
compile.call(mod, code, filename);
}
old(mod, filename);
}
function matcher(filename) {
// Here, you can inspect the filename to determine if it should be hooked or
// not. Just return a truthy/falsey. Files in node_modules are automatically ignored, unless otherwise specified (see below).
// TODO: Implement logic
return true;
}
// Now you can just do this!:
var revert = pirates.addHook(function hook(code, filename) {
return code.replace('@@foo', 'console.log(\'foo\');');
}, { exts: ['.js'], matcher: matcher });
// And later, if you want to un-hook require, you can just do:
revert();
Add a require hook. hook
must be a function that takes (code, filename)
, and returns the modified code. opts
is
an optional options object. Available options are: matcher
, which is a function that accepts a filename, and
returns a truthy value if the file should be hooked (defaults to a function that always returns true), falsey if
otherwise; exts
, which is an array of extensions to hook, they should begin with .
(defaults to ['.js']
);
ignoreNodeModules
, if true, any file in a node_modules
folder wont be hooked (the matcher also wont be called),
if false, then the matcher will be called for any files in node_modules
(defaults to true).
See the wiki page. If you add Pirates to your project, (And you should! It works best if everyone uses it. Then we can have a happy world full of happy require hooks!), please add yourself to the wiki.
FAQs
Properly hijack require, i.e., properly define require hooks and customizations
The npm package pirates receives a total of 28,061,622 weekly downloads. As such, pirates popularity was classified as popular.
We found that pirates demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 3 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Critics call the Node.js EOL CVE a misuse of the system, sparking debate over CVE standards and the growing noise in vulnerability databases.
Security News
cURL and Go security teams are publicly rejecting CVSS as flawed for assessing vulnerabilities and are calling for more accurate, context-aware approaches.
Security News
Bun 1.2 enhances its JavaScript runtime with 90% Node.js compatibility, built-in S3 and Postgres support, HTML Imports, and faster, cloud-first performance.