
Research
Security News
Lazarus Strikes npm Again with New Wave of Malicious Packages
The Socket Research Team has discovered six new malicious npm packages linked to North Korea’s Lazarus Group, designed to steal credentials and deploy backdoors.
The 'standard' npm package is a JavaScript style guide, linter, and formatter all in one. It enforces a consistent coding style without the need for configuration, making it easier to maintain code quality across projects.
Linting
Linting is the process of running a program that will analyze code for potential errors. The 'standard' package provides a zero-configuration linter that checks for style and programming errors.
npx standard
Auto-fixing
The 'standard' package can automatically fix some of the issues it finds in your code. This feature helps in maintaining code quality by automatically correcting common style and formatting issues.
npx standard --fix
Integration with Editors
The 'standard' package can be integrated with various code editors like VSCode, Sublime Text, and Atom. This allows for real-time linting and auto-fixing as you write code.
/* Example for VSCode */
{
"editor.formatOnSave": true,
"javascript.validate.enable": false,
"standard.enable": true
}
ESLint is a highly configurable linter for JavaScript and JSX. Unlike 'standard', which comes with a predefined set of rules, ESLint allows you to define your own rules or extend from popular style guides like Airbnb or Google.
Prettier is an opinionated code formatter that supports many languages. It focuses on code formatting rather than linting. While 'standard' includes both linting and formatting, Prettier is often used in conjunction with ESLint for a more comprehensive solution.
XO is a JavaScript linter with great defaults and minimal configuration. It is similar to 'standard' in that it aims to provide a zero-config experience, but it also allows for some customization and extends ESLint under the hood.
No decisions to make. No .eslintrc
, .jscsrc
, or .jscsrc
files to manage. It just
works.
This module saves you time in two ways:
npm install standard
"in this lil' string"
(
or [
;
like this ;[1, 2, 3].join(' ')
if (condition) { ... }
function name (arg1, arg2) { ... }
self
var self = this
window.self
when var self = this
is omitted===
instead of ==
obj == null
is allowed for succinctness (obj === null || obj === undefined
)err
function parameterTo get a better idea, take a look at a sample file written in JavaScript Standard Style.
The easiest way to use JavaScript Standard Style to check your code is to install it
globally as a Node command line program. To do so, simply run the following command in
your terminal (flag -g
installs standard
globally on your system, omit it if you want
to install in the current working directory):
npm install standard -g
After you've done that you should be able to use the standard
program. The simplest use
case would be checking the style of all JavaScript files in the current working directory:
$ standard
Error: Code style check failed:
lib/torrent.js:950:11: Expected '===' and instead saw '=='.
First, install standard
. Then, install the appropriate plugin for your editor:
package.json
{
"name": "my-cool-package",
"devDependencies": {
"standard": "*"
},
"scripts": {
"test": "standard && node my-normal-tests.js"
}
}
npm test
$ npm test
Error: Code style check failed:
lib/torrent.js:950:11: Expected '===' and instead saw '=='.
The beauty of JavaScript Standard Style is that it's simple. No one wants to maintain
multiple hundred-line .jshintrc
and .jscsrc
for every module/project they work on.
Enough of this madness!
This module saves you time in two ways:
The paths node_modules/
, .git/
, *.min.js
, bundle.js
, and coverage/
are automatically excluded
when looking for .js
files to style check.
Sometimes you need to ignore additional folders or specific minfied files. To do that, add
a standard.ignore
property to package.json
:
"standard": {
"ignore": [
"**/out/**",
"**/lib/select2/**",
"**/lib/ckeditor/**"
]
}
Yes, try using Max Ogden's experimental auto formatter
standard-format
to fix the easier
cases.
In rare cases, you'll need to break a rule and hide the warning generated by standard
.
JavaScript Standard Style uses eslint
and
jscs
under-the-hood and you can hide their warnings as you normally
would if you used each linter directly.
To get verbose output (so you can find the particular rule name to ignore), run:
$ standard --verbose
Error: Code style check failed:
routes/error.js:20:36: 'file' was used before it was defined. (eslint/no-use-before-define)
routes/submit.js:85:2: Expected indentation of 2 characters (jscs/validateIndentation)
The first error is from eslint
. In this case, the rule name is "no-use-before-define".
You can hide it with a /*eslint-disable no-use-before-define */
comment. Re-enable with
a /*eslint-enable no-use-before-define */
comment.
Example:
/*eslint-disable no-use-before-define */
// offending code here...
/*eslint-enable no-use-before-define */
The second error is from jscs
. In this case, the rule name is "validateIndentation".
You can hide it with a // jscs:disable validateIndentation
comment. Re-enable with a
// jscs:enable validateIndentation
comment.
No. Use eslint
or jscs
directly if you want that.
Pro tip: Just use standard
and move on. There are actual real problems that you could
spend your time solving :p
standard
prints to stderr
. This means that tools that read from stdout
won't be
able to read its output. The solution is to make standard
print to stdout
instead:
standard 2>&1 | grep variable
MIT. Copyright (c) Feross Aboukhadijeh.
FAQs
JavaScript Standard Style
The npm package standard receives a total of 306,143 weekly downloads. As such, standard popularity was classified as popular.
We found that standard demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 16 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
The Socket Research Team has discovered six new malicious npm packages linked to North Korea’s Lazarus Group, designed to steal credentials and deploy backdoors.
Security News
Socket CEO Feross Aboukhadijeh discusses the open web, open source security, and how Socket tackles software supply chain attacks on The Pair Program podcast.
Security News
Opengrep continues building momentum with the alpha release of its Playground tool, demonstrating the project's rapid evolution just two months after its initial launch.