
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
scriptlet engine for node.js
A scriptlet is a piece of JavaScript code that could finish running in finite time.
These kinds of code can be regarded as scriptlet
These kinds of code can NOT be regarded as scriptlet
Unlike standard Node.js module, scriptlet are defined in AMD style.
You can easly run a scriptlet via this package.
// helper.js
//
// this defines a static object
define({
log(message) {
console.log(message)
}
})
// rm.js
//
// this defines a async function, will be evaluated while running
// 'fs-extra' is a standard node.js module
// './helper' is a relative scriptlet file defined above
// '$in' is a injected value upon running, see 'index.js'
define('fs-extra', '../helper', '$in', async function(fs, helper, $in) {
helper.log(`unlinking file ${$in}`)
await fs.unlink($in)
})
// index.js
//
// this runs the scriptlet rm.js with $in injected
const scriptlet = require('scriptlet')
const path = require('path')
async function main() {
await scriptlet.run(path.join(__dirname, 'rm.js'), {
// inject the '$in' arguments
extra: new Map(['$in', process.argv[2]]),
// use mtime based cache policy
cache: 'mtime'
})
}
main()
You can build a scriptlet based web server with hot-reload support or even build your own Amazon Lambda Service.
Guo Y.K., MIT License
FAQs
scriptlet engine for node.js
The npm package scriptlet receives a total of 1 weekly downloads. As such, scriptlet popularity was classified as not popular.
We found that scriptlet demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.