
Research
/Security News
Weaponizing Discord for Command and Control Across npm, PyPI, and RubyGems.org
Socket researchers uncover how threat actors weaponize Discord across the npm, PyPI, and RubyGems ecosystems to exfiltrate sensitive data.
___ ___ _____ _______ _______
| | | _| || __||_ _|
|- -|| ||__ | | |
|___|___||_______||_______| |___|
XJST is a DSL for universal data transformations with compiler written on top of the Node.js and Ometa/JS and output code working in any browser or on server-side.
Yes, traverse any data in specific flow using matching against conditions set to generate any output (see binary tree prefixer).
For example, XJST can be used as:
XJST makes possible to extend your previous transformation by overriding or
specializing some of it's parts (example below is extending
this.url === '/login'
condition with redirection for logged in users).
XJST is a superset of JavaScript so you can use any popular libraries (that is jquery or underscore) within your transformation and write condition bodies in JavaScript.
Creating your own DSL based on XJST is also possible, because it's syntax parser is powered by ometajs.
Input:
template(this.url === '/')(function() {
return render('home page')
});
template(this.url === '/login')(function() {
return render('login form')
});
template(this.url === '/login', this.cookie.is_logined)(function() {
return redirect('user page')
});
Output (simplified):
switch (this.url) {
case '/login':
switch (this.cookie.is_logined) {
case true:
return redirect('user page')
default:
return render('login form')
}
case '/':
return render('home page')
}
npm install xjst
var xjst = require('xjst'),
fn = xjst.compile('template string', 'filename.xjst', options);
fn({ your: 'data' });
XJST extends JavaScript syntax with a following keywords: template
, local
,
apply
, applyNext
.
template(expression1 === value1, ... , expressionN === valueN)(function() {
// will be run if condition above equals to true
})
Multiple template
statements will be grouped to construct optimal conditions
graph. Order of the template
statements matters, the priority decreases from
the bottom to the top.
There're few restrictions for templates:
Expressions in template predicate should have no side-effects (that is should not change transformation context).
It's preferred to use function calls or equality comparisons joined by
logical &&
operator for expressions, as it can be better optimized at
compilation time.
var obj = { x: 1 };
console.log(local(obj)({ x: 2 })(obj.x)); // 2
console.log(obj.x); // 1
local
allows you to make temporary changes to a visible variables scope. Every
assignment put inside parens will be reverted immediately after the expression
execution.
You can make multiple assignments in the one statement:
local({ x: 2, y: 3 })(/* your code */)
Or use local
with a block:
local({ ... })(function() { var a = 1; return a * 2; });
Or as an expression:
var newX = local(this)({ x: 2 })(this.x);
template(true)(function() {
return apply({ type: 'first' });
});
template(this.type === 'first')(function() {
return apply({ type: 'second' });
});
template(this.type === 'second')(function() {
return 'here am I';
});
XJST is intended to be applied recursively to the same data, while making small
temporary changes to it (all changes will be reverted back after operation).
apply
keyword works exactly like a local
(applying changes in the parens and
reverting them after the execution), but with small distinction - apply
doesn't have a body, so it's just doing some changes to the data and applying
template recursively (the context will be preserved).
template(this.page === 'home' && this.action === 'login')(function() {
// match here
});
template(this.page === 'home')(function() {
applyNext();
});
applyNext()
call will reapply all templates, except one where it was called,
to the inputs data.
$ bin/xjst --help
Usage:
xjst [OPTIONS] [ARGS]
Options:
-h, --help : Help
-i INPUT, --input=INPUT : Input file (default: stdin)
-o OUTPUT, --output=OUTPUT : Output file (default: stdout)
$ bin/xjst -i template.xjst
.... some code ...
XJST takes all the template
statements and produces a tree with comparisons in
nodes and template
bodies in leafs. apply
are handled and replaced by
direct calls to the tree nodes (some of comparisons can be skipped, using
known context state).
Input:
template(this.type === 'a')(function() {
// body 1
});
template(this.type === 'b')(function() {
// body 2
});
Output (simplified):
switch (this.type) {
case 'a':
// body 1
break;
case 'b':
// body 2
break;
}
Here is the documented source.
Some technical details (in Russian) can be found in doc/tech.ru.md.
FAQs
XSLT inspired JavaScript templates (with spices)
We found that xjst demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 4 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
Socket researchers uncover how threat actors weaponize Discord across the npm, PyPI, and RubyGems ecosystems to exfiltrate sensitive data.
Security News
Socket now integrates with Bun 1.3’s Security Scanner API to block risky packages at install time and enforce your organization’s policies in local dev and CI.
Research
The Socket Threat Research Team is tracking weekly intrusions into the npm registry that follow a repeatable adversarial playbook used by North Korean state-sponsored actors.