Security News
vlt Debuts New JavaScript Package Manager and Serverless Registry at NodeConf EU
vlt introduced its new package manager and a serverless registry this week, innovating in a space where npm has stagnated.
Properly hijack require, i.e., properly define require hooks and customizations
The pirates npm package is designed to add hooks to Node.js's require function, allowing developers to modify the behavior of module loading. This can be particularly useful for tasks such as compiling code on-the-fly, implementing custom loaders, or applying transformations to module sources before they are executed.
Adding a hook to require
This feature allows you to add a custom transformation hook to Node.js's require function for files with specific extensions. In the code sample, a hook is added for '.js' files, where you can transform the code before it's executed. The `revert` function can be called to remove the hook.
const { addHook } = require('pirates');
const revert = addHook((code, filename) => {
// Transform the code here
return code;
}, {
exts: ['.js']
});
Similar to pirates, @babel/register modifies the Node.js module loading behavior to transpile ES6+ code on-the-fly using Babel. While pirates provides a generic API for hooking into the require function, @babel/register is specifically tailored for Babel transformations.
ts-node is another package that provides functionality similar to pirates but is focused on TypeScript. It allows TypeScript files to be executed and imported directly by patching Node.js's module loading system. Unlike pirates, which is agnostic to the type of transformations applied, ts-node specifically compiles TypeScript to JavaScript.
Two reasons:
super
.For some context, see the Babel issue thread which started this all, then the nyc issue thread, where discussion was moved (as we began to discuss just using the code nyc had developed), and finally to #1 where discussion was finally moved.
npm install --save pirates
Using pirates is really easy:
// my-module/register.js
const addHook = require('pirates').addHook;
// Or if you use ES modules
// import { addHook } from 'pirates';
function matcher(filename) {
// Here, you can inspect the filename to determine if it should be hooked or
// not. Just return a truthy/falsey. Files in node_modules are automatically ignored,
// unless otherwise specified in options (see below).
// TODO: Implement your logic here
return true;
}
const revert = addHook(
(code, filename) => code.replace('@@foo', 'console.log(\'foo\');'),
{ exts: ['.js'], matcher }
);
// And later, if you want to un-hook require, you can just do:
revert();
Add a require hook. hook
must be a function that takes (code, filename)
, and returns the modified code. opts
is
an optional options object. Available options are: matcher
, which is a function that accepts a filename, and
returns a truthy value if the file should be hooked (defaults to a function that always returns true), falsey if
otherwise; exts
, which is an array of extensions to hook, they should begin with .
(defaults to ['.js']
);
ignoreNodeModules
, if true, any file in a node_modules
folder wont be hooked (the matcher also wont be called),
if false, then the matcher will be called for any files in node_modules
(defaults to true).
See the wiki page. If you add Pirates to your project, (And you should! It works best if everyone uses it. Then we can have a happy world full of happy require hooks!), please add yourself to the wiki.
FAQs
Properly hijack require, i.e., properly define require hooks and customizations
The npm package pirates receives a total of 21,888,846 weekly downloads. As such, pirates popularity was classified as popular.
We found that pirates demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 3 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
vlt introduced its new package manager and a serverless registry this week, innovating in a space where npm has stagnated.
Security News
Research
The Socket Research Team uncovered a malicious Python package typosquatting the popular 'fabric' SSH library, silently exfiltrating AWS credentials from unsuspecting developers.
Security News
At its inaugural meeting, the JSR Working Group outlined plans for an open governance model and a roadmap to enhance JavaScript package management.