
Research
Namastex.ai npm Packages Hit with TeamPCP-Style CanisterWorm Malware
Malicious Namastex.ai npm packages appear to replicate TeamPCP-style Canister Worm tradecraft, including exfiltration and self-propagation.
uri-templates
Advanced tools
URI Templates (RFC6570) in JavaScript, including de-substitution.
It is tested against the official test suite, including the extended tests.
The "de-substitution" extracts parameter values from URIs. It is also tested against the official test suite (including extended tests).
In Node:
var uriTemplates = require('uri-templates');
var template1 = uriTemplates("/date/{colour}/{shape}/");
In browser:
var template2 = new UriTemplate("/prefix/{?params*}");
// "/categories/green/round/"
var uri1 = template1.fill({colour: "green", shape: "round"});
// "/prefix/?a=A&b=B&c=C
var uri2 = template2.fillFromObject({
params: {a: "A", b: "B", c: "C"}
});
// "/categories/example_colour/example_shape/"
var uri1b = template1.fill(function (varName) {
return "example_" + varName;
});
var uri2b = "/prefix/?beep=boop&bleep=bloop";
var params = template2.fromUri(url2b);
/*
{
params: {
beep: "boop",
bleep: "bloop"
}
}
*/
While templates can be ambiguous (e.g. "{var1}{var2}"), it will still produce something that reconstructs into the original URI.
It can handle all the cases in the official test suite, including the extended tests:
var template = uriTemplate("{/id*}{?fields,token}");
var values = template.fromUri("/person/albums?fields=id,name,picture&token=12345");
/*
{
id: ["person", 'albums"],
fields: ["id", "name", "picture"],
token: "12345"
}
*/
strict optionSometimes, you might want a more exact match, instead of a best guess. For example, this could be useful when using URI Templates for routing.
The strict option performs more checks, to see whether the URI being matched is plausible:
var template = uriTemplate("/prefix/{value}/{suffix}");
// Matches, even though "foo/bar" contains a "/" which is not allowed
var looseMatch = template.fromUri('/prefix/foo/bar/suffix');
// Does not match
var strictMatch = template.fromUri('/prefix/foo/bar/suffix', {strict: true});
var uri2b = "/prefix/?beep=boop&bleep=bloop";
var isMatch = template2.test(url2b); // === true
This returns a boolean, and takes the same options as .fromUri().
This project is released as public-domain. Anybody can modify or re-license it for any purpose, without restriction.
The 'uritemplate' package is another implementation of URI templates based on RFC 6570. It provides similar functionality to 'uri-templates' for parsing and expanding URI templates. However, 'uritemplate' focuses on providing a more comprehensive and flexible API for handling URI templates.
The 'url-template' package is a lightweight library for parsing and expanding URI templates. It offers a straightforward API and is designed to be easy to use. Compared to 'uri-templates', 'url-template' may have a simpler interface but might lack some advanced features.
The 'uri-template-lite' package is a minimalistic implementation of URI templates. It provides basic functionality for parsing and expanding URI templates with a focus on performance and small footprint. It is suitable for use cases where a lightweight solution is preferred over a feature-rich one.
FAQs
URI Templates (RFC6570) including de-substitution
The npm package uri-templates receives a total of 747,916 weekly downloads. As such, uri-templates popularity was classified as popular.
We found that uri-templates demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Malicious Namastex.ai npm packages appear to replicate TeamPCP-style Canister Worm tradecraft, including exfiltration and self-propagation.

Product
Explore exportable charts for vulnerabilities, dependencies, and usage with Reports, Socket’s new extensible reporting framework.

Product
Socket for Jira lets teams turn alerts into Jira tickets with manual creation, automated ticketing rules, and two-way sync.