
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
(out-of-service) asynchronous CommonJS require module loader for Node and browsers
Q-REQUIRE
Asynchronous CommonJS require module loader for Node and browsers.
The browser implementation is good for development where the JavaScript is hosted on the same domain of origin as the page, for live debugging. For production, it is generally preferable to build a module transport bundle and to put it on a CDN.
Implements:
Node:
$ npm install q-require
var REQUIRE = require("q-require/require");
var LOADER = require("q-require/loader");
// construct a require()
var loader = LOADER.Loader({"paths": [__dirname + "/examples/package/"]});
var require2 = REQUIRE.Require({"loader": loader});
// load the main module, asynchronously
var promise = require2.exec("main");
var Q = require("q");
var SYS = require("sys");
Q.when(promise, function (main) {
// ok
SYS.puts(main);
}, function (reason) {
// error
SYS.puts(SYS.inspect(reason));
});
Browser:
<script src="require.min.js"></script>
<script>
require = Require("path/to/js");
// async require a main module
require.exec("main");
// or
require.ensure(["foo", "bar", "baz"], function (require) {
var FOO = require("foo");
var BAR = require("bar");
var BAZ = require("baz");
});
</script>
This asynchronous loader uses a simple heuristic for analyzing dependencies; it reads all require calls with string literals. You'll need to trick the regular expression if you have require calls that do not imply static dependency, like require((id)). If you have a dynamic dependency, use require.ensure or require.exec to asynchronously advance require to include additional modules and their transitive dependencies.
require.min.js includes ECMAScript 5 shims, so more Object, Array, String, and Date functions are guaranteed to work. It also bootstraps require with the following modules:
FAQs
(out-of-service) asynchronous CommonJS require module loader for Node and browsers
The npm package q-require receives a total of 2 weekly downloads. As such, q-require popularity was classified as not popular.
We found that q-require demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.