
Security News
/Research
Wallet-Draining npm Package Impersonates Nodemailer to Hijack Crypto Transactions
Malicious npm package impersonates Nodemailer and drains wallets by hijacking crypto transactions across multiple blockchains.
JavaScript bindings for prql-compiler
.
npm install prql-js
Currently these functions are exposed
function compile(prql_query: string, options?: CompileOptions): string;
function prql_to_pl(prql_query: string): string;
function pl_to_rq(pl_json: string): string;
function rq_to_sql(rq_json: string): string;
Direct usage
const prqljs = require("prql-js");
const sql = prqljs.compile(`from employees | select first_name`);
console.log(sql);
Options
const opts = new prql.CompileOptions();
opts.target = "sql.mssql";
opts.format = false;
opts.signature_comment = false;
const sql = prqljs.compile(`from employees | take 10`, opts);
console.log(sql);
Template literal
const prqljs = require("prql-js");
const prql = (string) => prqljs.compile(string[0] || "");
const sql = prql`from employees | select first_name`;
console.log(sql);
Template literal with newlines
const prqljs = require("prql-js");
const prql = (string) => prqljs.compile(string[0] || "");
const sql = prql`
from employees
select first_name
`;
console.log(sql);
<html>
<head>
<script src="./node_modules/prql-js/dist/web/prql_js.js"></script>
<script>
const { compile } = wasm_bindgen;
async function run() {
await wasm_bindgen("./node_modules/prql-js/dist/web/prql_js_bg.wasm");
const sql = compile("from employees | select first_name");
console.log(sql);
}
run();
</script>
</head>
<body></body>
</html>
import compile from "prql-js/dist/bundler";
const sql = compile(`from employees | select first_name`);
console.log(sql);
Errors are returned as following object, serialized as a JSON array:
interface ErrorMessage {
/// Message kind. Currently only Error is implemented.
kind: "Error" | "Warning" | "Lint";
/// Machine-readable identifier of the error
code: string | null;
/// Plain text of the error
reason: string;
/// A list of suggestions of how to fix the error
hint: string | null;
/// Character offset of error origin within a source file
span: [number, number] | null;
/// Annotated code, containing cause and hints.
display: string | null;
/// Line and column number of error origin within a source file
location: SourceLocation | null;
}
/// Location within the source file.
/// Tuples contain:
/// - line number (0-based),
/// - column number within that line (0-based),
interface SourceLocation {
start: [number, number];
end: [number, number];
}
These errors can be caught as such:
try {
const sql = prqlJs.compile(`from employees | foo first_name`);
} catch (error) {
const errorMessages = JSON.parse(error.message).inner;
console.log(errorMessages[0].display);
console.log(errorMessages[0].location);
}
Build:
npm run build
This builds Node, bundler and web packages in the dist
path.
Test:
npm test
wasm-pack
to
generate bindings1.npm
layer on top of the usual approach of just using
wasm-pack
, so we can distribute a single package with targets of node
,
bundler
and no-modules
— somewhat inverting the approach recommended by
wasm-pack
. The build instruction goes in a build
script, rather than a
pack
script.Though we would be very open to other approaches, given wasm-pack does not seem maintained, and we're eliding many of its features to build for three targets. See https://github.com/PRQL/prql/issues/1836 for more details. ↩
0.9.5 — 2023-09-16
0.9.5 adds a line-wrapping character, fixes a few bugs, and improves our CI. The release has 77 commits from 8 contributors. Selected changes are below.
Look out for some conference talks coming up over the next few weeks, including QCon SF on Oct 2 and date2day on Oct 12.
Language:
A new line-wrapping character, for lines that are long and we want to break up into multiple physical lines. This is slightly different from from many languages — it's on the subsequent line:
from artists
select is_europe =
\ country == "DE"
\ || country == "FR"
\ || country == "ES"
This allows for easily commenting out physical lines while maintaining a correct logical line; for example:
from artists
select is_europe =
\ country == "DE"
\ || country == "FR"
\ || country == "FR"
-\ || country == "ES"
+#\ || country == "ES"
(@max-sixty, #3408)
Fixes:
Fix stack overflow on very long queries in Windows debug builds (@max-sixty, #2908)
Fix panic when unresolved lineage appears in group or window (@davidot, #3266)
Fix a corner-case in handling precedence, and remove unneeded parentheses in some outputs (@max-sixty, #3472)
Web:
Integrations:
Internal changes:
New Contributors:
FAQs
JavaScript bindings for prqlc
The npm package prql-js receives a total of 777 weekly downloads. As such, prql-js popularity was classified as not popular.
We found that prql-js demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 3 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
/Research
Malicious npm package impersonates Nodemailer and drains wallets by hijacking crypto transactions across multiple blockchains.
Security News
This episode explores the hard problem of reachability analysis, from static analysis limits to handling dynamic languages and massive dependency trees.
Security News
/Research
Malicious Nx npm versions stole secrets and wallet info using AI CLI tools; Socket’s AI scanner detected the supply chain attack and flagged the malware.