Security News
GitHub Removes Malicious Pull Requests Targeting Open Source Repositories
GitHub removed 27 malicious pull requests attempting to inject harmful code across multiple open source repositories, in another round of low-effort attacks.
The requizzle npm package is designed to modify the behavior of Node.js's require function. It allows users to intercept and modify the module loading process, which can be useful for a variety of tasks such as injecting dependencies, modifying module exports, or applying patches to modules before they are returned by require.
Intercepting and modifying module loading
This feature allows you to create a custom require function that can intercept the module loading process. The 'requirePaths' option specifies additional paths to search for modules. The 'infect' option, when set to true, causes all subsequently required modules to also be loaded with this custom require function.
const Requizzle = require('requizzle');
const options = {
requirePaths: [__dirname],
infect: true
};
const myRequire = Requizzle(options);
const myModule = myRequire('./myModule');
Modifying module exports
This feature allows you to add extra properties or methods to the exports of any module loaded with the custom require function. The 'extras' option is a function that receives the target module's exports and can modify them before they are returned.
const Requizzle = require('requizzle');
const options = {
extras: function (target) {
target.extraProperty = 'This is an extra property!';
}
};
const myRequire = Requizzle(options);
const myModule = myRequire('./myModule');
console.log(myModule.extraProperty);
Proxyquire is a package that allows you to override dependencies during testing. It is similar to requizzle in that it modifies the behavior of require, but it is specifically designed for mocking modules in test scenarios, making it more suitable for testing rather than general module interception and modification.
Rewire adds a special setter and getter to modules so you can modify their behavior or state. Like requizzle, it allows for modification of module exports, but rewire focuses on changing private variables and connecting them to an external scope, which is particularly useful for testing purposes.
Module-alias allows you to create aliases for directories, register custom module paths, and map them to a new path. It's similar to requizzle in that it affects module resolution, but it does so by providing a simpler aliasing mechanism rather than intercepting the require function.
Swizzle a little something into your Node.js modules.
Requizzle provides a drop-in replacement for Node.js's require()
function.
This replacement enables you to change a module's source code when Node.js loads
the module.
You can use Requizzle in your test cases, or in production code if you like to live dangerously.
There are several different ways:
With Requizzle, you can add directories to the module lookup path, which forces Node.js to search those directories for modules. This can be useful if:
require('../../../../../lib/foo')
.Tamper with modules to your heart's delight by adding arbitrary code before or after the module's own source code.
When you use Requizzle to require a module, you can force each child module's
require
method to inherit your changes to the parent module. (By default, only
the parent module is changed.)
Probably not. It's true that Requizzle gives you plenty of new and exciting ways to tamper with, and possibly break, your module dependencies. But Requizzle also tries not to break anything on its own. In particular:
fs
or path
, Requizzle won't mess with
it.The Requizzle module exports a single function, which returns a drop-in
replacement for require()
.
When you call the function, you must pass in an options
object, which can
include any of these properties:
extras
: A pair of functions that return text to insert before or after the
module's source code. Each function accepts two parameters: targetPath
, the
path to the required module, and parentModule
, the Module
object for the
module's parent. Each function must return a string.
extras.before
: A function that returns text to insert before the
module's source code.extras.after
: A function that returns text to insert after the module's
source code.infect
: Determines whether child modules are infected with the same changes
as the parent module. Set to true
to force child modules to inherit your
changes. Defaults to false
.
requirePaths
: Additional paths to search for required modules. For example,
if requirePaths
is set to ['/usr/lib/junk/modules']
, and you save a
JavaScript module at /usr/lib/junk/modules/mymodule.js
, you can require the
module as mymodule
.
You can provide an array of paths, which will be searched before the default module paths, or an object with the following properties:
requirePaths.before
: An array of paths to search before the default
module paths.requirePaths.after
: An array of paths to search after the default module
paths. Use this property if you want the module to use its own local
dependencies when possible, then fall back to the additional paths if
necessary.By default, the require path is not changed.
const requizzle = require('requizzle');
// Say hello and goodbye to each module.
const logRequire = requizzle({
extras: {
before: function(targetPath, parentModule) {
return 'console.log("Hello %s!", ' + targetPath + ');\n';
},
after: function(targetPath, parentModule) {
return 'console.log("Goodbye %s!", ' + targetPath + ');\n';
}
}
});
// Prints "Hello /path/to/mymodule.js!" and "Goodbye /path/to/mymodule.js!"
const myModule = logRequire('mymodule');
// Look for modules in the current module's `lib` directory, and force child
// modules to do the same.
const path = require('path');
const extraPathRequire = requizzle({
infect: true,
requirePaths: [path.join(__dirname, 'lib')]
});
// If `foo` needs to require a module in `./lib`, it can use `require('bar')`
// instead of `require('./lib/bar')`.
const foo = extraPathRequire('./foo');
Here are some problems you might run into when you use Requizzle, along with solutions to each problem. If you run into any problems that aren't addressed here, please file a new issue!
Requizzle adds minimal overhead to the module-loading process. However, your code will run much slower than usual if you do both of the following:
infect
option.require()
calls within the scope of
individual functions.If Requizzle seems to slow down your app, look for module calls that are within function scope, then move them to each module's top-level scope.
Do you have any circular dependencies in the modules that aren't working? Circular dependencies can cause unusual behavior with Requizzle, just as they can without Requizzle. Try breaking the circular dependency.
Fair enough.
node:
prefix, as in require('node:fs')
.requirePaths
option no longer inserts an extra
line break into the source file.requirePaths
option can now contain before
and
after
properties. Paths in the before
property will be searched first; paths
in the after
property will be searched last.requirePaths
option is used, the module loader now
searches the extra paths first rather than last.Requizzle is very loosely adapted from Johannes Ewald's rewire module, which is designed to modify a module's behavior for unit testing. If Requizzle doesn't meet your needs, please take a look at rewire!
FAQs
Swizzle a little something into your require() calls.
The npm package requizzle receives a total of 1,954,915 weekly downloads. As such, requizzle popularity was classified as popular.
We found that requizzle demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
GitHub removed 27 malicious pull requests attempting to inject harmful code across multiple open source repositories, in another round of low-effort attacks.
Security News
RubyGems.org has added a new "maintainer" role that allows for publishing new versions of gems. This new permission type is aimed at improving security for gem owners and the service overall.
Security News
Node.js will be enforcing stricter semver-major PR policies a month before major releases to enhance stability and ensure reliable release candidates.