
Research
SANDWORM_MODE: Shai-Hulud-Style npm Worm Hijacks CI Workflows and Poisons AI Toolchains
An emerging npm supply chain attack that infects repos, steals CI secrets, and targets developer AI toolchains for further compromise.
Use JavaScript with the familiar Underscore.js API with extra goodies like and asynchronous (reactive) execution and lazy generators and callback processes.
Works with any-promise library (a pollyfill, es6-promise, promise, native-promise-only, bluebird, rsvp, when, q ... your choice) for asynchronous execution.
If you are not familiar with transducers, check out Transducers Explained.
Underarm is an extension to underscore-transducer. All methods there work with Underarm as well. Underarm allows any transducer to become asynchronous: Promises can be used and returned in init, step and result. If the transformation is not marked async behaves exactly the same as underscore-transducer.
Install your Promise library preference before underarm and it will be auto detected and used.
Include an ES6 Promise Pollyfill. Then include the browser version of underarm.
Library uses any-promise to allow choice of Promise library.
$ npm install promise # or es6-promise, bluebird, q, when, rsvp ... see any-promise
$ npm install underarm
Uses transduce-async to support promises in transducer init, step and result.
Marks chained transformation as asynchronous. See below for changes to API when async.
Resolve value as underscore-transducer if not async. If chained transformation is async returns a promise for the value of the transformation
Marks chained transformation as async and adds Promise listeners to Promise value. This means that any chained transformation is a promise.
Like a normal compose when chained transformation not async. If async all arguments are interleaved with defer. This allows any transducer in composed pipeline to step or result a Promise in addition to a value. The wrapped transformer is called with value of resolved Promise.
Like a normal transduce when chained transformation is async. If async, init and coll can be a Promise and xf can be an async transducer. The value of coll can be anything that can be converted to an iterator using transduce-protocol. The return value is a Promise for the result of the transformation.
Like a normal into when chained transformation not async. If async, to and from can be a Promise and xf can be an async transducer.
Like a normal sequence when chained transformation not async. If async, coll can be a Promise and xf can be an async transducer.
Create an async transducer that allows wrapped transformer to step or result a Promise in addition to a value. All items will be queued and processed asap. The wrapped transformer is called with value of resolved Promise.
Create an async transducer that delays step of wrapped transformer by wait milliseconds. All items will be queued and delayed and step will return a promise that will resolve after wait milliseconds for each item.
Only steps results when Underscore.js throttle calls the function. Accepts same arguments (and uses same function) as underscore.
Only steps results when Underscore.js debounce calls the function. Accepts same arguments (and uses same function) as underscore.
MIT
FAQs
Transducers for JavaScript with Underscore API and Async extensions
The npm package underarm receives a total of 16 weekly downloads. As such, underarm popularity was classified as not popular.
We found that underarm demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
An emerging npm supply chain attack that infects repos, steals CI secrets, and targets developer AI toolchains for further compromise.

Company News
Socket is proud to join the OpenJS Foundation as a Silver Member, deepening our commitment to the long-term health and security of the JavaScript ecosystem.

Security News
npm now links to Socket's security analysis on every package page. Here's what you'll find when you click through.