Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
sl-istanbul-lib-instrument
Advanced tools
SL update to the core istanbul API for JS code coverage
Istanbul instrumenter library.
Version 1.1.x now implements instrumentation using Babel
. The implementation is inspired
by prior art by @dtinth as demonstrated in the __coverage__
babel plugin.
It provides 2 "modes" of instrumentation.
The old API that is mostly unchanged (except for incompatibilities noted) and performs the instrumentation using babel as a library.
A programVisitor
function for the Babel AST that can be used by a Babel plugin
to emit instrumentation for ES6 code directly without any source map
processing. This is the preferred path for babel users. The Babel plugin is
called babel-plugin-istanbul
.
Incompatibilities and changes to instrumentation behavior can be found in v0-changes.md.
FAQs
SL update to the core istanbul API for JS code coverage
The npm package sl-istanbul-lib-instrument receives a total of 104,225 weekly downloads. As such, sl-istanbul-lib-instrument popularity was classified as popular.
We found that sl-istanbul-lib-instrument demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.