Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
polyfill-checker
Advanced tools
Cross browser built-in functions/objects compatibility checker.
npm install polyfill-checker
Import and initialize polyfill checker before your application runs:
if (process.env.NODE_ENV !== 'production') {
const { PolyfillChecker } = require('polyfill-checker')
const checker = new PolyfillChecker({
minBrowsers: {
ie: '9',
safari: '10',
chrome_android: '60',
}
})
checker.downgradeMode()
// checker.injectChecker()
}
It uses browser-compat-data to check browser compatibility.
You can find more in example project
PolyfillChecker
constructor takes one optional config parameter, see defaultConfig.
Removes not compatible built-ins (according to minBrowsers
) from the browser.
Your code will fail everytime you use such built-in without appropriate polyfill.
Injects checker interceptors to the not compatible built-ins (according to minBrowsers
) and warns you in the console when using it.
Note: Many 3rd party libraries use new built-ins if available (e.g. React uses Symbol, etc.) and frameworks may also use unsupported features in dev mode (e.g. during hot reload).
You can either ignore related errors or exclude such built-ins from checker (exclude
config).
Be carefull when using exclude config and include appropriate polyfill or don't use the feature in production code.
Note: Using both injectChecker
and downgradeMode
doesn't make sense. You should use only one of them.
3rd party libraries and frameworks often includes some polyfills into your application. We provide presets to exclude those polyfilled built-ins from the checker:
const {
PolyfillChecker,
createReactAppPreset, // create-react-app
} = require('polyfill-checker')
const checker = new PolyfillChecker({
exclude: [createReactAppPreset]
})
Contributions are welcome! Just open an issues with any idea or pull-request if it is no-brainer. Make sure all tests and linting rules pass.
FAQs
Cross browser polyfill and builtins checker
We found that polyfill-checker demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.