
Research
Malicious npm Packages Impersonate Flashbots SDKs, Targeting Ethereum Wallet Credentials
Four npm packages disguised as cryptographic tools steal developer credentials and send them to attacker-controlled Telegram infrastructure.
用于 Handlebars (>=1.0.12) 的七牛插件。
使用七牛的图片处理 API,解决构造图片地址的需求。
var hbs = require('handlebars')
var qiniuHelper = require('qiniu-hbs')
qiniuHelper.register(hbs, {
imageServer: 'http://qiniuphotos.qiniudn.com/'
, watermark: 'watermark.jpg'
})
以下示例均使用这个对象进行渲染。
var hbs = require('handlebars')
var o = {
picture: 'gogopher.jpg',
pictures: ['gogopher.jpg', 'qiniu.jpg']
}
hbs.compile('templates')(o)
{{qiniu picture}}
> http://qiniuphotos.qiniudn.com/gogopher.jpg
{{qiniu picture 400}}
> http://qiniuphotos.qiniudn.com/gogopher.jpg?imageView/1/w/400
{{qiniu picture 400 300}}
> http://qiniuphotos.qiniudn.com/gogopher.jpg?imageView/1/w/400/h/300
imageView
{{qiniu picture 400 300 imageView='2'}}
> http://qiniuphotos.qiniudn.com/gogopher.jpg?imageView/2/w/400/h/300
{{qiniu picture 400 300 imageView='2' watermark='watermark.jpg'}}
> http://qiniuphotos.qiniudn.com/gogopher.jpg?imageView/2/w/400/h/300|watermark/1/image/aHR0cDovL3Fpbml1cGhvdG9zLnFpbml1ZG4uY29tL3dhdGVybWFyay5qcGc_aW1hZ2VWaWV3LzIvdy8xMDA=/dissolve/100/gravity/SouthEast/dx/10/dy/10
{{qiniux picture 400 300}}
> http://qiniuphotos.qiniudn.com/gogopher.jpg?imageView/1/w/400/h/300|watermark/1/image/aHR0cDovL3Fpbml1cGhvdG9zLnFpbml1ZG4uY29tL3dhdGVybWFyay5qcGc_aW1hZ2VWaWV3LzIvdy8xMDA=/dissolve/100/gravity/SouthEast/dx/10/dy/10
{{qiniu pictures 400 300}}
> http://qiniuphotos.qiniudn.com/gogopher.jpg
当图片 hash 为 falsy 值,使用默认地址//placehold.it/%sx%s
,可通过注册选项(default
)覆盖。需提供两个占位符作为宽高。
var hbs = require('handlebars')
hbs.compile('{{qiniu noop 100 200}}')({})
> //placehold.it/100x200
FAQs
Handlebars Helpers for building qiniu image url.
The npm package qiniu-hbs receives a total of 0 weekly downloads. As such, qiniu-hbs popularity was classified as not popular.
We found that qiniu-hbs demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Four npm packages disguised as cryptographic tools steal developer credentials and send them to attacker-controlled Telegram infrastructure.
Security News
Ruby maintainers from Bundler and rbenv teams are building rv to bring Python uv's speed and unified tooling approach to Ruby development.
Security News
Following last week’s supply chain attack, Nx published findings on the GitHub Actions exploit and moved npm publishing to Trusted Publishers.