
Security News
vlt Launches "reproduce": A New Tool Challenging the Limits of Package Provenance
vlt's new "reproduce" tool verifies npm packages against their source code, outperforming traditional provenance adoption in the JavaScript ecosystem.
Templating engine with the combined powers of handlebars, front-matter, JSON Schema and Sjablong-fields
A Sjablong-field starts with [[ and ends with ]]
Inbetween the tags you define keyvalue-pair in the format key="value"
The only required key in a Sjablong-field is path. This it path in the data it should be replaced with.
The Sjablong-fields can be used to generate a JSONSchema to validate the data with.
Key | Description | Required | Example |
---|---|---|---|
label | Name/title of the field | No | Fornavn |
path | The path in the data object it should be replaced with | Yes | name.firstname |
description | Description of the field | No | Firstname of the recipient |
required | Should the field be required? | No | true |
default | The default value of the field | No | Bjarne |
preview | If replacePlacehold's preview option is true | No | Bjarne |
Sjablong-felt on a single line
[[label="fornavn":path="name.firstname"]]
Sjablong-felt with multiline default value
[[label="test":path="test":default="Line1\nLine2\nLine3"]]
Sjablong-felt on multiple lines (It is not necessary to indent the pairs)
[[
label="fornavn"
path="name.firstname"
]]
Sjablong-felt on multiple lines with more fields
[[
label="fornavn"
path="name.firstname"
descriptione="First name of the recipient"
required="true"
default="Max"
preview="Bjarne"
]]
FAQs
A system for replacing and/or validating replacement-fields in text
The npm package sjablong receives a total of 5 weekly downloads. As such, sjablong popularity was classified as not popular.
We found that sjablong demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
vlt's new "reproduce" tool verifies npm packages against their source code, outperforming traditional provenance adoption in the JavaScript ecosystem.
Research
Security News
Socket researchers uncovered a malicious PyPI package exploiting Deezer’s API to enable coordinated music piracy through API abuse and C2 server control.
Research
The Socket Research Team discovered a malicious npm package, '@ton-wallet/create', stealing cryptocurrency wallet keys from developers and users in the TON ecosystem.