
Research
Namastex.ai npm Packages Hit with TeamPCP-Style CanisterWorm Malware
Malicious Namastex.ai npm packages appear to replicate TeamPCP-style Canister Worm tradecraft, including exfiltration and self-propagation.
Conditional compilation tool for javascript
Barbarian way to make custom builds
It takes the source code
if (Whatever.hasFeature("foo")){
doFunctionFoo();
} else {
console.log("I haven't feature foo!");
}
if (__environment !== 'production'){
console.debug("I'm in debug environment");
}
and the state
{
"Whatever": {
"hasFeature": function(feature){
if (feature === 'foo'){
return true;
}
}
},
"__environment": "Dark basement"
}
and returns following:
if (true){
doFunctionFoo();
} else {
console.log("I haven't feature foo!");
}
if (true){
console.debug("I'm in debug environment");
}
This is not a minifier/compressor. It just inlines constants.
This is not a dead code removal tool. There are some expression computations, but Rhubarb doesn't touch block
statements. I would like to drop if branches if the condition was calculated, but found that this
apparently simple feature is actually tricky and error-prone.
UglifyJS2 is a great compression tool with conditional compilation. Unfortunately, it cannot always guess if expression evaluates constant value.
This tool can. With your little help.
And you can use functions/methods!
Currently it only can be used as a module.
There's only one method, inline with following signature:
require("rhubarb").inline(code, state [, options]);
code is a javascript code.
state is an object that is used as global.
If state has (in javascript operator is used) value, it is used for replacement.
If it hasn't, code stays the same.
options is an optional object with options:
Described the way identifiers are resolved into variables.
global (default) - only global variables (and its properties) are replaced.flat - variables are replaced everywhere, even if there's a local variables with same nameundeclared - same as global, but if a global variable was defined (for example, with var), it is skippedSure, we cannot prceisely define all the state at the build time.
There's a special object UNCOMPUTABLE exported from module.
If any variable, property or function result equals to UNCOMPUTABLE, it will be ignored.
There's no need to assign this value of all properties, if state or any its descendant properties was not defined
(hasOwnProperty in JavaScript), it's assumed to be uncomputable. This approach doesn't work for function calls.
If you're going to return an object, make sure all uncomputable properties are marked explicitly.
FAQs
Compile-time js constant inliner
We found that rhubarb demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Malicious Namastex.ai npm packages appear to replicate TeamPCP-style Canister Worm tradecraft, including exfiltration and self-propagation.

Product
Explore exportable charts for vulnerabilities, dependencies, and usage with Reports, Socket’s new extensible reporting framework.

Product
Socket for Jira lets teams turn alerts into Jira tickets with manual creation, automated ticketing rules, and two-way sync.