
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
reflect-args
Advanced tools
Lets you retrieve argument names, including default values from outside a function.
This npm module defines a means of retrieving parameters from a function from outside the function. It works with any function or closure, including methods, but not with constructors wrapped inside ES6 classes.
$ npm install reflect-args
Before using it, we need to define it:
const getArgs = require('reflect-args').getArgs
The getArgs function takes in a function and returns a Map containing all
the parameters of that function.
let func = function (foo, bar = 12, test = '12', cb = () => {}) {
// TODO: body stub
}
console.log(getArgs(func))
/* Expected output:
* Map {
* 'foo' => undefined,
* 'bar' => 12,
* 'test' => '12',
* 'cb' => [Function: cb]
* }
*/
let Class = class Test
{
constructor () {}
func (foo, bar) {
}
}
let inst = new Class()
console.log(getArgs(inst.func))
/* Expected output:
* Map {
* 'foo' => undefined,
* 'bar' => undefined
* }
*/
Sometimes you may want to let the end user (programmer) use pattern matching
inside their function whose arguments are reflected. During such cases, the
getArgs function will give the keys the names of an incrementing range:
let patternMatched = function ({foo, bar}, test, [more, and])
{
}
console.log(getArgs(patternMatched))
/* Expected output:
* Map {
* '__0' => '{foo, bar}',
* 'test' => undefined,
* '__1' => '[more, and]'
* }
*/
The way this works is by utilizing the Function.prototype.toString function,
by extracing the arguments from that string. This means that if the code is
obfuscated, this will not work.
That same sentence holds true for reflection done in any other language. If the code is obfuscated, the reflected variable names will be changed into whatsoever they were obfuscated into.
As for most cases, there is no point in minifying (thus obfuscating) server-side code, as we do not actually have to send the data to some client, thus saving on band-width. If, for some reason, you would like to minify server-sided code using this module, make sure the minifier does not obfuscate away variable names.
FAQs
Lets you retrieve argument names, including default values from outside a function.
We found that reflect-args demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.