
Research
Security News
Malicious npm Packages Target BSC and Ethereum to Drain Crypto Wallets
Socket uncovered four malicious npm packages that exfiltrate up to 85% of a victim’s Ethereum or BSC wallet using obfuscated JavaScript.
third-party-capital
Advanced tools
Third Party Capital is a resource that consolidates best practices for loading popular third-parties in a single place.
The project provides implementations that can be used in the following languages:
src
directory)inc
directory)There is a large, cross-functional Chrome initiative that aims to improve third-party resource loading on the web. One part of this effort is to provide a default set of recommendations, or "components," to developers. These components will help developers sequence and fetch popular third-party resources at the right time to minimize their overall impact to page performance.
Instead of duplicating these recommendations in multiple places and expecting maintainers for each tool to keep them up to date, Third Party Capital consolidates them in a single repository with an API. This API makes it possible for consumers to import the recommendations directly within their tooling.
Here's a demo of a @next/third-parties
package that shows how Next.js can import recommendations from Third Party Capital and re-export them as framework components at build-time.
Third Party Capital is an experimental library and its specification is subject to change.
The loading recommendation for each third-party resource is defined with the following JSON schema:
{
id: string;
description: string;
website?: string;
html?: {
element: string;
attributes: {
[string]?: string,
src?: {
url: string;
slugParam: string;
params: Array<string>;
}
};
};
stylesheets?: Array<string>;
scripts?: Array<{
key?: string;
url: string | {
url: string;
};
params: Array<string> ;
optionalParams?: Record<string, string | number | undefined | null>;
strategy: "server" | "client" | "idle" | "worker";
location: "head" | "body";
action: "append" | "prepend";
} | {
key?: string;
code: string;
params: Array<string> ;
optionalParams?: Record<string, string | number | undefined | null>;
strategy: "server" | "client" | "idle" | "worker";
location: "head" | "body";
action: "append" | "prepend";
}>;
}
These properties provide a heuristic for consumers to decide how, when, and where to load a particular third-party to minimize its impact on performance. Here are the details:
attributes
property allows you to include a list of any default attributes and their values which will be overwritten if the user specifies a different value. The src
attribute is the only property that needs to follow a specific structure:
* A value must be included for at least one of the main attributes (content, stylesheets, or scripts)
Third Party Capital is an experimental library and the list of supported third parties is subject to change.
The third-party resources that are currently provided in Third Party Capital, along with their suggested loading practices, are:
loading
attribute to lazy load the embedAlthough the details are still being finalized, only a select number of third-parties that meet certain usage criteria will be included. Please do not submit any requests to include new third-parties.
Third Party Capital would be able to provide loading details for many third-parties, but some scenarios cannot be supported with the current schema:
FAQs
Unknown package
The npm package third-party-capital receives a total of 597,116 weekly downloads. As such, third-party-capital popularity was classified as popular.
We found that third-party-capital demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket uncovered four malicious npm packages that exfiltrate up to 85% of a victim’s Ethereum or BSC wallet using obfuscated JavaScript.
Security News
TC39 advances 9 JavaScript proposals, including Array.fromAsync, Error.isError, and Explicit Resource Management, which are now headed into the ECMAScript spec.
Security News
Vite releases Rolldown-Vite, a Rust-based bundler preview offering faster builds and lower memory usage as a drop-in replacement for Vite.