Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
The v8flags npm package is used to fetch the flags available for the V8 JavaScript engine that Node.js runs on. It provides an API to programmatically access the list of V8 command-line flags, which can be useful for tools that spawn child processes of Node.js and need to pass flags to the V8 engine.
Fetching V8 flags
This feature allows you to fetch the available V8 flags for the current version of Node.js. The flags are returned as an array of strings, each representing a command-line flag that can be used with V8.
const v8flags = require('v8flags');
v8flags.then(flags => console.log(flags));
Caching V8 flags
v8flags caches the flags to a file to avoid the performance cost of spawning a new process on subsequent calls. You can specify a custom cache directory by configuring the package.
const v8flags = require('v8flags');
v8flags.config({
cacheDir: '/path/to/cache/directory'
});
v8flags.then(flags => console.log(flags));
Minimist is a package that helps parse argument options, which is somewhat related to v8flags in that it deals with command-line arguments. However, minimist does not provide a list of V8 flags; it simply parses the arguments passed to a script.
Commander is a complete solution for node.js command-line interfaces, which includes parsing user-supplied command-line options. While it does not provide V8 flags, it is used for a similar purpose of handling command-line arguments.
Yargs is another node.js library for building command-line tools, which parses command-line arguments and generates an elegant user interface. It's similar to v8flags in that it deals with command-line options but does not specifically provide V8 flags.
Get available v8 and Node.js flags.
const v8flags = require('v8flags');
v8flags(function (err, results) {
console.log(results);
// [ '--use_strict',
// '--es5_readonly',
// '--es52_globals',
// '--harmony_typeof',
// '--harmony_scoping',
// '--harmony_modules',
// '--harmony_proxies',
// '--harmony_collections',
// '--harmony',
// ...
});
v8flags(cb)
Finds the available flags and calls the passed callback with any errors and an array of flag results.
v8flags.configfile
The name of the cache file for flags.
v8flags.configPath
The filepath location of the configfile
above.
MIT
FAQs
Get available v8 and Node.js flags.
The npm package v8flags receives a total of 3,245,189 weekly downloads. As such, v8flags popularity was classified as popular.
We found that v8flags demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.