
Security News
/Research
Wallet-Draining npm Package Impersonates Nodemailer to Hijack Crypto Transactions
Malicious npm package impersonates Nodemailer and drains wallets by hijacking crypto transactions across multiple blockchains.
github.com/flynnfc/bagginsdb
Baggins DB is a simple Cassandra-inspired wide-column db. While not production-ready, it serves as an educational project to explore low-level database internals, concurrency control, and performance-tuning techniques. Learn more on how it's made here
Memtable (In-Memory Index):
Stores recently written data in a sorted skiplist for quick insertion and retrieval. Once it reaches a certain size threshold, it is flushed to disk as an immutable SSTable.
SSTables (On-Disk Storage):
Writes are organized into append-only, immutable files known as SSTables. Each SSTable is sorted by key and includes:
Compaction:
Over time, multiple SSTables are merged and deduplicated into a single larger SSTable. This process, known as compaction, reduces storage fragmentation and stabilises read performance by limiting the number of SSTables that must be searched.
TrueTime Integration (Mocked):
The code incorporates a truetime
component, simulating reliable timestamp generation, similar in spirit to Google’s TrueTime, though far simpler and not distributed. This allows the program to avoid distributed locks and choose the newest value during compactions.
internal/database/
Contains the core database logic including:
database.go
: The Database
struct that ties together mem-tables, SSTableManager, and timing.memtable.go
, skiplist.go
: In-memory skiplist for quick writes and reads.sstable.go
, sstable_manager.go
: Handling on-disk SSTables, building them from memtables, indexing, and merging them during compaction.internal/truetime/
Mock time service that provides timestamps for record inserts.
simulation/
Contains load-testing and simulation scripts that run various scenarios:
logger/
A simple logging wrapper configured to produce structured logs via zap
.
I've opted to track and log performance at quite a granular level. You can find saved graphs and performance notes in the Performance folder
This project is distributed under the MIT License. See LICENSE
for details.
FAQs
Unknown package
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
/Research
Malicious npm package impersonates Nodemailer and drains wallets by hijacking crypto transactions across multiple blockchains.
Security News
This episode explores the hard problem of reachability analysis, from static analysis limits to handling dynamic languages and massive dependency trees.
Security News
/Research
Malicious Nx npm versions stole secrets and wallet info using AI CLI tools; Socket’s AI scanner detected the supply chain attack and flagged the malware.