Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
webworkify
Advanced tools
launch a web worker that can require() in the browser with browserify
First, a main.js
file will launch the worker.js
and print its output:
var work = require('webworkify');
var w = work(require('./worker.js'));
w.addEventListener('message', function (ev) {
console.log(ev.data);
});
w.postMessage(4); // send the worker a message
then worker.js
can require()
modules of its own. The worker function lives
inside of the module.exports
:
var gamma = require('gamma');
module.exports = function (self) {
self.addEventListener('message',function (ev){
var startNum = parseInt(ev.data); // ev.data=4 from main.js
setInterval(function () {
var r = startNum / Math.random() - 1;
self.postMessage([ startNum, r, gamma(r) ]);
}, 500);
});
};
Now after browserifying this example, the console will contain output from the worker:
[ 4, 0.09162078520553618, 10.421030346237066 ]
[ 4, 2.026562457360466, 1.011522336481017 ]
[ 4, 3.1853125018703716, 2.3887589540750214 ]
[ 4, 5.6989969260510005, 72.40768854476167 ]
[ 4, 8.679491643020487, 20427.19357947782 ]
[ 4, 0.8528139834191428, 1.1098187157762498 ]
[ 4, 8.068322137547542, 5785.928308309402 ]
...
var work = require('webworkify')
Return a new
web worker
from the module at modulePath
.
The file at modulePath
should export its worker code in module.exports
as a
function that will be run with no arguments.
Note that all the code outside of the module.exports
function will be run in
the main thread too so don't put any computationally intensive code in that
part. It is necessary for the main code to require()
the worker code to fetch
the module reference and load modulePath
's dependency graph into the bundle
output.
The worker w
returned by webworkify
has the property objectURL
attached.
w.objectURL
refers to the Object URL that was used to pass the module's source
to the worker, and can be cleaned up using URL.revokeObjectURL()
. (See example)
With npm do:
npm install webworkify
MIT
FAQs
launch a web worker that can require() in the browser with browserify
The npm package webworkify receives a total of 84,812 weekly downloads. As such, webworkify popularity was classified as popular.
We found that webworkify demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 3 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.