
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
A small string templating utility. Use it to replace tags (tokens, e.g. Hello {myToken}) within strings
using one or more Objects for replacements (e.g. {myToken: "world!"}).
The utiltity by default exports a function to replace one or more tokens ("Some string {token1}, {token2}")
within a string.
The tokens are replaced using one or more objects containing the tokens to replace as keys and the
values to replace it/them with (
[imported interpolator]("Some string {token1}, {token2}", {token1: "one"}, token2: "two"}))).
The module exports
interpolateFactory),interpolate function (default),interpolateClear function (which clears empty placeholders) andString.prototype with symbolic methods.The repository is available at two locations: Github (US) and Codeberg (Europe).
US politics may result in precarious future US/Github policies, which may result in the Github repository ceasing to exist in the future.
The Codeberg repository is therefore authorative.
Check the DEMO @Codeberg, or the DEMO @Github.
<!-- the browser script is located at /Bundle/index.script.min.js -->
<script src="[browser script location]"></script>
<script>
const {default: splat /* [, interpolateClear, interpolateFactory, addSymbolicStringExtensions] */} = SplatES;
splat(hi, {wrld: "world"}); // "hi world"
</script>
// the module is located at /index.js,
// or bundled at /Bundle/index.min.js
import {default as splat /* [, interpolateClear, interpolateFactory, addSymbolicStringExtensions] */}
from "[path/to]/Interpolate.node.js]";
splat(hi, {wrld: "world"}); // "hi world"
FAQs
a small module for ES string interpolation
We found that splat-es demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.