Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
use-plugin
Advanced tools
For use in framework modules to provide a plugin mechanism for extensions. While a simple require in calling code is a good start, this plugin provides some convenience abstractions over vanilla requires so that you can offer a more user-friendly interface.
If you're using this module, feel free to contact us on twitter if you have any questions! :) @senecajs
See the seneca module for an example of practical usage.
// myframework.js
module.exports = function() {
var use = require('use-plugin')({prefix:'foo',module:module})
return {
use: function( plugin_name ) {
var plugin_description == use(plugin_name)
// call the init function to init the plugin
plugin_description.init()
}
}
}
// callingcode.js
var fm = require('myframework')
// this will try to load:
// 'bar', 'foo-bar', './foo', './foo-bar'
// against the framework module, and then the callingcode module
// nice error messages are thrown if there are problems
fm.use('bar')
npm install use-plugin
There's an npm module page for use-plugin.
The module provides a builder function that you call with your desired options. In particular, you should always set your module, as above.
The builder function returns a plugin loader function that you can use inside your framework. Calling the loader function returns an object with properties that describe the plugin.
In particular, the point of this module is to resolve (via require), the init function of the plugin, so that you can call it in your framework.
Plugins can be loaded in the following ways:
fm.use('bar')
fm.use('bar', {color:'red'})
fm.use(function(){...})
fm.use(function bar(){...})
fm.use(function bar(){...}, {color:'red'})
fm.use({name:'bar', init:function(){...}})
fm.use( require('./bar.js' ) )
When loaded as an Object, you must provide at least the name and init function. When loaded as a require note that the returned value can be any of string, function or object, to which the same rules apply. In particular, you need to explicitly provide a name property if you want an explicit name.
Note that plugins cannot have the same names as builtin Node.js
modules. You can however change the list of builtin Node.js module
names using the system_modules
option.
The name of the plugin is determined by the following procedure:
The plugin may also have a tag. This is a separate string that allows multiple plugins with the same name to be loaded, depending on your use-case. To provide a tag, use the name format: name$tag, or provide a tag property on the plugin object or function specification.
When calling the builder function, you can pass:
If found, an object is returned describing your plugin:
FAQs
Generic plugin loader functionality for Node.js frameworks.
The npm package use-plugin receives a total of 7,124 weekly downloads. As such, use-plugin popularity was classified as popular.
We found that use-plugin demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.