
Research
Using Trusted Protocols Against You: Gmail as a C2 Mechanism
Socket uncovers malicious packages on PyPI using Gmail's SMTP protocol for command and control (C2) to exfiltrate data and execute commands.
= Introduction
There are many tools out there that help you obfuscate, compress, compile or uglify your JavaScript so the file size will be smaller, the script will load faster and the code will be harder to steal.
This CLI utility simplifies the process of compiling your JS files by letting you choose your compression library and use it with a single command:
$ jsc compile
= Supported Compilers
=== Google Closure
https://developers.google.com/closure/
The Closure Compiler compiles JavaScript into compact, high-performance code. The compiler removes dead code and rewrites and minimizes what's left so that it downloads and runs quickly. It also checks syntax, variable references, and types, and warns about common JavaScript pitfalls. These checks and optimizations help you write apps that are less buggy and easier to maintain.
=== YUI Compressor
http://yui.github.io/yuicompressor/
The YUI Compressor is written in Java (requires Java >= 1.4) and relies on Rhino to tokenize the source JavaScript file. It starts by analyzing the source JavaScript file to understand how it is structured. It then prints out the token stream, omitting as many white space characters as possible, and replacing all local symbols by a 1 (or 2, or 3) letter symbol wherever such a substitution is appropriate (in the face of evil features such as eval or with, the YUI Compressor takes a defensive approach by not obfuscating any of the scopes containing the evil statement).
=== Uglifier
https://github.com/lautis/uglifier
Ruby wrapper for UglifyJS JavaScript compressor.
= Installation
gem install jscompiler
= Configuration
To setup your project with some default parameters, run the following command:
$ jsc init
This command will ask you a few questions about your project. If you don't like being asked questions and prefer to configure your project manually, just create a .jscompiler file in your project folder and provide the following information:
source_root: "src" # Relative path from the project root to Where your JavaScript files are located
compiler:
name: "closure" # Name of the compiler to use. By default "closure" compiler will be used
groups: # Groups of files you wish to compile
default:
files: # List of the JS files in the order they will be compiled
- src/file1.js
- src/file2.js
- src/file3.js
output:
path: "build/default.min.js" # Relative path to where the output files should be created
just1and3:
compiler: # You can even specify different compilers for different groups
name: "yahoo"
files:
- src/file1.js
- src/file3.js
output:
path: "build/just1and3.min.js"
You can configure any number of groups. The files in the groups will be concatenated and compiled in the order you entered them in.
= Execution
Once you have configured your file groups, you can run the compile command:
$ jsc c
This will compile all groups. To compile only a specific group, provide the group name:
$ jsc c -g just1and3
To get help on any of the tasks, run:
$ jsc
= Watching folders for changes
Many times you want the compilation to be done automatically when you change the JavaScript files. JSC provides this option as well.
You can start watching the source_root folder for changes by running the following command:
$ jsc w
Any time a JavaScript file is changed anywhere in the folder, the JSC will find all of the groups where the file is listed and compile these groups.
= Contribution
Clone the repository, make any changes you like and send me a pull request.
FAQs
Unknown package
We found that jscompiler demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Socket uncovers malicious packages on PyPI using Gmail's SMTP protocol for command and control (C2) to exfiltrate data and execute commands.
Product
We redesigned Socket's first logged-in page to display rich and insightful visualizations about your repositories protected against supply chain threats.
Product
Automatically fix and test dependency updates with socket fix—a new CLI tool that turns CVE alerts into safe, automated upgrades.