Research
Security News
Threat Actor Exposes Playbook for Exploiting npm to Build Blockchain-Powered Botnets
A threat actor's playbook for exploiting the npm ecosystem was exposed on the dark web, detailing how to build a blockchain-powered botnet.
The precinct npm package is used to find dependencies in JavaScript and other file types. It helps in identifying the modules that a given file depends on, which can be useful for various tasks such as dependency analysis, bundling, and more.
JavaScript Dependency Detection
This feature allows you to detect dependencies in JavaScript files. By passing the content of a JavaScript file to the precinct function, it returns an array of dependencies.
const precinct = require('precinct');
const content = 'const foo = require("foo");';
const dependencies = precinct(content);
console.log(dependencies); // ['foo']
CSS Dependency Detection
This feature allows you to detect dependencies in CSS files. By specifying the type as 'css', precinct can parse and return the dependencies in CSS files.
const precinct = require('precinct');
const content = '@import "foo.css";';
const dependencies = precinct(content, { type: 'css' });
console.log(dependencies); // ['foo.css']
TypeScript Dependency Detection
This feature allows you to detect dependencies in TypeScript files. By specifying the type as 'ts', precinct can parse and return the dependencies in TypeScript files.
const precinct = require('precinct');
const content = 'import foo from "foo";';
const dependencies = precinct(content, { type: 'ts' });
console.log(dependencies); // ['foo']
Madge is a JavaScript library that can create graphs of your module dependencies. It supports ES6, CommonJS, and AMD modules. Compared to precinct, madge provides more visualization features and can generate dependency graphs.
Dependency-tree is a library for generating a dependency tree from a file or directory. It supports various module formats including ES6, CommonJS, and AMD. Unlike precinct, dependency-tree focuses on creating a hierarchical tree structure of dependencies.
Detective is a library for finding the dependencies of a JavaScript file. It supports both CommonJS and ES6 modules. Detective is similar to precinct in its core functionality but is more focused on JavaScript and does not support other file types like CSS or TypeScript.
Unleash the detectives
npm install --save precinct
Uses the appropriate detective to find the dependencies of a file or its AST.
Supports:
var precinct = require('precinct');
var content = fs.readFileSync('myFile.js', 'utf8');
// Pass in a file's content or an AST
var deps = precinct(content);
You may pass options (to individual detectives) based on the module type via an optional second object argument `detective(content, options), for example:
Example call: precinct(content, { amd: { skipLazyLoaded: true } });
amd
, commonjs
, es6
, sass
, stylus
, less
Current options:
amd.skipLazyLoaded
: tells the AMD detective to omit lazy-loaded dependencies (i.e., inner requires).es6.mixedImports
: allows for all dependencies to be fetched from a file that contains both CJS and ES6 imports.css.url
: tells the CSS detective to include url()
references to images, fonts, etc.Finding non-JavaScript (ex: Sass and Stylus) dependencies:
var content = fs.readFileSync('styles.scss', 'utf8');
var deps = precinct(content, { type: 'sass' });
var deps2 = precinct(content, { type: 'stylus' });
Or, if you just want to pass in a filepath and get the dependencies:
var paperwork = require('precinct').paperwork;
var deps = paperwork('myFile.js');
var deps2 = paperwork('styles.scss');
precinct.paperwork(filename, options)
Supported options:
includeCore
: (default: true) set to false
to exclude core Node dependencies from the list of dependencies.fileSystem
: (default: undefined) set to an alternative fs
implementation that will be used to read the file path.precinct(content, options)
.Assumes a global install of npm install -g precinct
precinct [options] path/to/file
precinct --help
to see optionsMIT
FAQs
Unleash the detectives
The npm package precinct receives a total of 1,232,214 weekly downloads. As such, precinct popularity was classified as popular.
We found that precinct demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 3 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A threat actor's playbook for exploiting the npm ecosystem was exposed on the dark web, detailing how to build a blockchain-powered botnet.
Security News
NVD’s backlog surpasses 20,000 CVEs as analysis slows and NIST announces new system updates to address ongoing delays.
Security News
Research
A malicious npm package disguised as a WhatsApp client is exploiting authentication flows with a remote kill switch to exfiltrate data and destroy files.