
Security Fundamentals
Turtles, Clams, and Cyber Threat Actors: Shell Usage
The Socket Threat Research Team uncovers how threat actors weaponize shell techniques across npm, PyPI, and Go ecosystems to maintain persistence and exfiltrate data.
The 'wildcard' npm package is designed to simplify the process of matching strings against a specified pattern using wildcards. It is commonly used in scenarios where there is a need to filter or search for data based on partial input, similar to the functionality seen in search engines or file searching utilities.
String Matching
This feature allows users to match strings against a pattern with wildcards. In the provided code, the wildcard pattern '*.js' is used to filter an array of filenames to find those that end with '.js'.
const wildcard = require('wildcard');
const pattern = '*.js';
const files = ['index.js', 'server.js', 'style.css'];
const matched = files.filter(file => wildcard(pattern, file));
console.log(matched); // Output: ['index.js', 'server.js']
Minimatch is a minimalistic matching library that uses the same glob pattern syntax as shell. It is more feature-rich than 'wildcard', offering additional options such as matching with braces, extended glob matching, and negation. It is widely used in build tools and file watchers.
Micromatch is a highly optimized globbing library that offers a balance between Minimatch and wildcard. It provides fine-grained control over the matching process and is faster and more efficient than Minimatch for most cases, making it suitable for performance-critical applications.
Very simple wildcard matching, which is designed to provide the same functionality that is found in the eve eventing library.
It works with strings:
var wildcard = require('wildcard');
console.log(wildcard('foo.*', 'foo.bar'));
// --> true
console.log(wildcard('foo.*', 'foo'));
// --> true
Arrays:
var wildcard = require('wildcard');
var testdata = [
'a.b.c',
'a.b',
'a',
'a.b.d'
];
console.log(wildcard('a.b.*', testdata));
// --> ['a.b.c', 'a.b', 'a.b.d']
Objects (matching against keys):
var wildcard = require('wildcard');
var testdata = {
'a.b.c' : {},
'a.b' : {},
'a' : {},
'a.b.d' : {}
};
console.log(wildcard('a.*.c', testdata));
// --> { 'a.b.c': {} }
Great for full file-based wildcard matching.
A well cared for and loved JS wildcard matcher.
Copyright (c) 2023 Damon Oehlman <mailto:damon.oehlman@gmail.com>
Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the 'Software'), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
FAQs
Wildcard matching tools
The npm package wildcard receives a total of 9,349,758 weekly downloads. As such, wildcard popularity was classified as popular.
We found that wildcard demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security Fundamentals
The Socket Threat Research Team uncovers how threat actors weaponize shell techniques across npm, PyPI, and Go ecosystems to maintain persistence and exfiltrate data.
Security News
At VulnCon 2025, NIST scrapped its NVD consortium plans, admitted it can't keep up with CVEs, and outlined automation efforts amid a mounting backlog.
Product
We redesigned our GitHub PR comments to deliver clear, actionable security insights without adding noise to your workflow.