
Research
PyPI Package Disguised as Instagram Growth Tool Harvests User Credentials
A deceptive PyPI package posing as an Instagram growth tool collects user credentials and sends them to third-party bot services.
unbox-primitive
Advanced tools
Unbox a boxed JS primitive value. This module works cross-realm/iframe, does not depend on instanceof
or mutable properties, and works despite ES6 Symbol.toStringTag.
var unboxPrimitive = require('unbox-primitive');
var assert = require('assert');
assert.equal(unboxPrimitive(new Boolean(false)), false);
assert.equal(unboxPrimitive(new String('f')), 'f');
assert.equal(unboxPrimitive(new Number(42)), 42);
const s = Symbol();
assert.equal(unboxPrimitive(Object(s)), s);
assert.equal(unboxPrimitive(new BigInt(42)), 42n);
// any primitive, or non-boxed-primitive object, will throw
Simply clone the repo, npm install
, and run npm test
v1.1.0 - 2024-12-15
npmignore
to autogenerate an npmignore file 348a5ad
a324230
es-value-fixtures
a321ae5
04a0e0d
@ljharb/eslint-config
, auto-changelog
, npmignore
, object-inspect
, object-is
, tape
7fff971
91d6807
call-bind
, has-symbols
, which-boxed-primitive
f8b6597
aud
, object-inspect
, tape
b3362a1
call-bound
directly e29ff5f
engines.node
d3420bc
aud
with npm audit
5e6a6d0
which-boxed-primitive
0ff873d
aud
dd0e373
4f79b24
FAQs
Unbox a boxed JS primitive value.
The npm package unbox-primitive receives a total of 38,831,434 weekly downloads. As such, unbox-primitive popularity was classified as popular.
We found that unbox-primitive demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
A deceptive PyPI package posing as an Instagram growth tool collects user credentials and sends them to third-party bot services.
Product
Socket now supports pylock.toml, enabling secure, reproducible Python builds with advanced scanning and full alignment with PEP 751's new standard.
Security News
Research
Socket uncovered two npm packages that register hidden HTTP endpoints to delete all files on command.