Research
Security News
Threat Actor Exposes Playbook for Exploiting npm to Build Blockchain-Powered Botnets
A threat actor's playbook for exploiting the npm ecosystem was exposed on the dark web, detailing how to build a blockchain-powered botnet.
Embed data in other data and easily extract it when needed
Can for example be useful when you run a child process that has multiple entities writing to stdout and you want to handle those outputs differently. I personally use it in run-jxa
to allow the code run in that context to use console.log
, but also allow me to send the result of the execution back through console.log
.
$ npm install subsume
const Subsume = require('subsume');
const subsume = new Subsume();
console.log(subsume.id);
//=> '7febcd0b3806fbc48c01d7cea4ed1219'
const text = subsume.compose('🦄');
//=> '@@[7febcd0b3806fbc48c01d7cea4ed1219]@@🦄##[7febcd0b3806fbc48c01d7cea4ed1219]##'
// The text can now be embedded in some other text
const output = `some${text} random text`;
//=> 'some@@[7febcd0b3806fbc48c01d7cea4ed1219]@@🦄##[7febcd0b3806fbc48c01d7cea4ed1219]## random text'
// At a later point we extract it
subsume.parse(output);
//=> {data: '🦄', rest: 'some random text'}
// Or in a different process by using the `id`
const input = 'some@@[7febcd0b3806fbc48c01d7cea4ed1219]@@🦄##[7febcd0b3806fbc48c01d7cea4ed1219]## random text';
Subsume.parse(text, '7febcd0b3806fbc48c01d7cea4ed1219');
//=> {data: '🦄', rest: 'some random text'}
Returns a new subsume
instance.
Type: string
Default: Unique ID
You probably don't need to set this. Can be useful if you need a stable ID.
Subsume
instance.
Type: Function
Returns a wrapped version of text
that you can embed in other content.
Type: Function
Extract your embedded data from text
.
Returns an object with properties .data
for your embedded data and .rest
for everything else.
Type: string
Used identifier.
Type: string
Prefix used in .compose()
.
Type: string
Postfix used in .compose()
.
Type: RegExp
Regex used in .parse()
.
Extract embedded data with a specific id
out of text
.
Useful when text
comes from an external source.
Extract embedded data corresponding to all IDs in idArray
, if specified. Otherwise it will extract embedded data for all top-level IDs.
Returns an object with properties .data
, a Map with an entry for each parsed ID, and .rest
for what remains after all the required IDs have been parsed, as seen below:
The input:
some@@[7febcd0b3806fbc48c01d7cea4ed1219]@@🦄##[7febcd0b3806fbc48c01d7cea4ed1219]## random@@[7febcd0b3806fbc48c01d7cea4ed1218]@@🦄##[7febcd0b3806fbc48c01d7cea4ed1218]## text@@[7febcd0b3806fbc48c01d7cea4ed1217]@@🦄##[7febcd0b3806fbc48c01d7cea4ed1217]##
Gives the following output:
{
data: Map {
'7febcd0b3806fbc48c01d7cea4ed1219' => '🦄',
'7febcd0b3806fbc48c01d7cea4ed1218' => '🦄',
'7febcd0b3806fbc48c01d7cea4ed1217' => '🦄'
},
rest: 'some random text'
}
MIT © Sindre Sorhus
FAQs
Embed data in other data and easily extract it when needed
We found that subsume demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A threat actor's playbook for exploiting the npm ecosystem was exposed on the dark web, detailing how to build a blockchain-powered botnet.
Security News
NVD’s backlog surpasses 20,000 CVEs as analysis slows and NIST announces new system updates to address ongoing delays.
Security News
Research
A malicious npm package disguised as a WhatsApp client is exploiting authentication flows with a remote kill switch to exfiltrate data and destroy files.