Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
scratch-parser
Advanced tools
The Scratch Parser is a Node.js module that parses and validates Scratch projects.
npm install scratch-parser
var fs = require('fs');
var parser = require('scratch-parser');
var buffer = fs.readFileSync('/path/to/project.sb2');
parser(buffer, function (err, project) {
if (err) // handle the error
// do something interesting
});
In addition to the _meta
data described above, Scratch projects include an attribute called info
that may include the following:
Key | Description |
---|---|
flashVersion | Installed version of Adobe Flash |
swfVersion | Version of the Scratch editor used to create the project |
userAgent | User agent used to create the project |
savedExtensions | Array of Scratch Extensions used in the project |
npm test
make coverage
make benchmark
This project uses semantic release to ensure version bumps follow semver so that projects using the config don't break unexpectedly.
In order to automatically determine the type of version bump necessary, semantic release expects commit messages to be formatted following conventional-changelog.
<type>(<scope>): <subject>
<BLANK LINE>
<body>
<BLANK LINE>
<footer>
subject
and body
are your familiar commit subject and body. footer
is
where you would include BREAKING CHANGE
and ISSUES FIXED
sections if
applicable.
type
is one of:
fix
: A bug fix Causes a patch release (0.0.x)feat
: A new feature Causes a minor release (0.x.0)docs
: Documentation only changesstyle
: Changes that do not affect the meaning of the code (white-space, formatting, missing semi-colons, etc)refactor
: A code change that neither fixes a bug nor adds a featureperf
: A code change that improves performance May or may not cause a minor release. It's not clear.test
: Adding missing tests or correcting existing testsci
: Changes to our CI configuration files and scripts (example scopes: Travis, Circle, BrowserStack, SauceLabs)chore
: Other changes that don't modify src or test filesrevert
: Reverts a previous commitUse the commitizen CLI to make commits formatted in this way:
npm install -g commitizen
npm install
Now you're ready to make commits using git cz
.
If you're committing a change that will require changes to existing code, ensure your commit specifies a breaking change. In your commit body, prefix the changes with "BREAKING CHANGE: " This will cause a major version bump so downstream projects must choose to upgrade the config and will not break the build unexpectedly.
FAQs
Parser for Scratch projects
We found that scratch-parser demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.