Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Node REPL that autoloads all modules in ./node_modules/
at startup, just like core libs.
Usage: repl-here [OPTION]...
Options:
-v, --verbose Print name table.
-l, --load-main Load module at current working directory.
-i MODULE, --ignore=MODULE Ignore module by name.
--verbose
flag prints a table describing how a particular module is named inside the REPL. Variable names are effectively camel-cased versions of module names.
--load-main
loads main module at process.cwd()
as path.basename(process.cwd())
.
ee = replHere(repl, basedir, [opts])
Require all modules from basedir/node_modules
into the repl (first argument).
Returns EventEmitter.
opts.loadMain
Type: Boolean
Default: false
Whether main module should be required from basedir
.
opts.ignore
Type: String
or [String]
Default: []
Module name or list of module names to ignore.
load
ee.on('fail', function(name, path))
Emitted if module name
is loaded from path
.
fail
ee.on('fail', function(name, path))
Emitted whenever module name
fails to load.
end
ee.on('end', function())
Emitted if repl
is done being populated with modules.
error
ee.on('error', function(err))
Emitted if a fatal error occurred. At this point repl
may be half-way populated or left intact.
repl-it works in the context of a project. It walks up the directory tree, parses package.json
for dependencies and devDependencies, has options like loading main project files, etc.
scratchy is sort of a hybrid of repl-it
and repl-here
: it walks up the directory tree as repl-it
does but requires everything inside node_modules
just like repl-here
. This means you can't simply npm install foo
and load it into the repl immediately afterwards (which is the problem this module is trying to solve).
npm install -g repl-here
MIT
FAQs
Start the REPL and load the entire ./node_modules/ into it
We found that repl-here demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.