
Security News
/Research
Wallet-Draining npm Package Impersonates Nodemailer to Hijack Crypto Transactions
Malicious npm package impersonates Nodemailer and drains wallets by hijacking crypto transactions across multiple blockchains.
Timl is an amalgamation of Tiny XML. I created it because I find the builder DSL to be a little bit cluttered and hard to digest at first glance.
Timl aims to be very small and very intuitive to use. The main code that does all of the heavy lifting is less than 100 lines of code, including comments.
The installation is a standard RubyGem installation:
gem install timl
The Timl DSL is very intuitive. It relies on some Ruby metaprogramming under the hood that will catch methods that have not been defined and define them. What this means to you, the user, is that you can use any XML tag you want as part of the DSL. Let's see an example:
require 'timl'
Timl.start do
body do
p { "This is a paragraph tag." }
end
end
The return value of that code is the following XML:
<body>
<p>
This is a paragraph tag.
</p>
</body>
Which is what you would expect, right?
The above example is a bit simple. What is you want attributes in your XML? Timl can do that too:
require 'timl'
Timl.start do
div id: "content" do
p style: "font-weight: bold" do
"This is a bold paragraph."
end
end
end
Which, unsurprisingly, produces the following XML (I realise these are HTML examples, but the library really isn't constrained to HTML):
<div id='content'>
<p style='font-weight: bold'>
This is a bold paragraph.
</p>
</div>
If you want to include XML and HTML header/doctype information, that's possible as well:
require 'timl'
Timl.start do
xml_header
end
Translates to:
<?xml version='1.0' encoding='UTF-8'?>
If you want to use a different encoding, that's possible too:
require 'timl'
Timl.start do
xml_header encoding: "UTF-16"
end
Translates to:
<?xml version='1.0' encoding='UTF-16'?>
The HTML doctype is inserted in a very similar way:
require 'timl'
Timl.start do
html5_doctype
end
Translates to:
<!DOCTYPE html>
Unfortunately doctypes before HTML5 are not currently supported. If there's overwhelming need for it in future, I might consider adding it.
If you want to contribute, please feel free. File an issue, fork the repo, submit a pull request, whatever you want to do. Please not, however, that I use git-flow as a branching strategy. If you aren't familiar with git-flow, look it up, learn it, love it :)
Please don't submit pull requests to master. Pull requests must go to develop and come from a feature branch. Thanks!
FAQs
Unknown package
We found that timl demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
/Research
Malicious npm package impersonates Nodemailer and drains wallets by hijacking crypto transactions across multiple blockchains.
Security News
This episode explores the hard problem of reachability analysis, from static analysis limits to handling dynamic languages and massive dependency trees.
Security News
/Research
Malicious Nx npm versions stole secrets and wallet info using AI CLI tools; Socket’s AI scanner detected the supply chain attack and flagged the malware.