
Research
Malicious fezbox npm Package Steals Browser Passwords from Cookies via Innovative QR Code Steganographic Technique
A malicious package uses a QR code as steganography in an innovative technique.
windmill-module-api
Advanced tools
安装依赖:
npm i windmill-module-api
初始化并注入接口:
import getAPIs from 'windmill-module-api'
// 获取接口(其中包含了 my 变量)
const apis = getAPIs()
// 向环境中添加接口
for (const key in apis) {
window[key] = apis[key]
}
以下环境变量由容器或者基础的前端框架提供,不需要额外添加。如果这些底层接口不存在,会影响某些上层 API 的功能。
__windmill_environment__
: 客户端注册的环境变量,用于实现 getSystemInfo
等接口。__WINDMILL_MODULE_GETTER__
: 小程序 worker 中基础前端框架注入的、用于获取原生模块的接口。如果环境中未提供,会尝试读取如下接口:
require
: 小程序 Rax/三方 DSL 透出的引入模块的接口。requireModule
: 小程序 Vue DSL 透出的引入模块的接口。weex.requireModule
: Weex 透出的引入模块的接口。__WINDMILL_WORKER_RUNTIME_APIS__
: 小程序 worker 中基础前端框架注入的、用于底层通信的接口,在实现一些复杂接口时会用到(如 Video 和 Audio 相关的接口)。给 getAPIs
函数传入特定格式的参数,可以拦截指定接口(预处理接口的参数)。
import getAPIs from 'windmill-module-api'
// 获取接口(其中包含了 my 变量)
const apis = getAPIs({
preprocessor: {
navigateTo (options) {
// Hack here
return options
}
}
})
preprocessor
由函数构成的对象,函数名就是要拦截的接口。其中每个函数的参数就是调用该接口时的原始参数,返回值是处理后的结果。
谨慎使用此功能,如果返回的参数和原始参数格式不一致,将会影响接口的使用!
FAQs
Standard module APIs of windmill.
We found that windmill-module-api demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
A malicious package uses a QR code as steganography in an innovative technique.
Research
/Security News
Socket identified 80 fake candidates targeting engineering roles, including suspected North Korean operators, exposing the new reality of hiring as a security function.
Application Security
/Research
/Security News
Socket detected multiple compromised CrowdStrike npm packages, continuing the "Shai-Hulud" supply chain attack that has now impacted nearly 500 packages.