Research
Security News
Quasar RAT Disguised as an npm Package for Detecting Vulnerabilities in Ethereum Smart Contracts
Socket researchers uncover a malicious npm package posing as a tool for detecting vulnerabilities in Etherium smart contracts.
github.com/nmjmdr/microservices-redis-stream
This project makes use of redis-streams [https://redis.io/topics/streams-intro] to communicaate business events among micro-services.
The project has the following microservices written in GO:
Accounts service has two pre-loaded accounts: Account Name: one, Owned by: user1 Account Name: two, Onwed by: user2
Account service also host authentication endpoint: /auth/login Ideally auth is best hosted as different service.
The core idea behind the design is that Services publish business events that occur, other services listen to these events from the event-stream and update their data store or react in a way which is fit for them
----------+ +---------
Customer |-----------------> Publish to redis-stream ~~~~~~~ <------ Read from redis stream ---- | Accounts service
service | (CustomerCreated, InvoiceCreated, |
| InvoiceDeleted, CustomerDeleted...) |
| |
|-----------------> Read fromredis-stream ~~~~~~~ <------ Publish to redis stream ------|
----------+ (AccountCreated, AccountDeleted) +---------
Thus when an a customer is created, the accounts service which is responsible for providing the details about the aggregate revenue for an account does the following:
It creates a new record for the customer in its own data store (saving only the relevant details)
Later when an Invoice is created for a customer, the accounts service gets to know about it from the event stream, and then it:
It adds the new invoice amount as delta to the existing sum of all invoices for that customer
Thus each services reacts to business events in a way its sees fit.
The services start consuming from the event stream at start-up. It is imperative for the service to start consuming the events from the right event. The right event is from where the server had last consumed successfullly. The service has to maintain an event log in persistance store. This event log has to save the id of the event last consumed.
The service can then pass the last event id to subscriber.Listen
method, which then returns the list of events from the event onwards.
POST: http://localhost:8080/customers
Body:
{
"name": "John Adams",
"account_id": "1"
}
(Currently the account is not being validated for existence)
When a customer is created, its details are published as CustomerCreated
event to event-stream
redis-stream:
127.0.0.1:6379> XREAD STREAMS event-stream 0
1) 1) "event-stream"
2) 1) 1) "1553318690326-0"
2) 1) "Payload"
2) "{\"id\":\"7\",\"account_id\":\"1\",\"name\":\"Martin North 4\",\"created_date\":\"0001-01-01T00:00:00Z\"}"
3) "EventTypeName"
4) "CustomerCreated"
POST: http://localhost:8080/invoices
{
"customer_id": "7",
"purchase_date": "2019-01-06",
"purchase_price_cents": 10000
}
When an invoice is created, its details are published as InvoiceCreated
event to redis stream (event-stream
):
9) 1) "1553343729026-0"
2) 1) "EventTypeName"
2) "InvoiceCreated"
3) "Payload"
4) "{\"id\":\"10\",\"customer_id\":\"9\",\"purchase_price_cents\":8000,\"created_date\":\"0001-01-01T00:00:00Z\",\"purchase_date\":\"2019-01-09\"}"
FAQs
Unknown package
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket researchers uncover a malicious npm package posing as a tool for detecting vulnerabilities in Etherium smart contracts.
Security News
Research
A supply chain attack on Rspack's npm packages injected cryptomining malware, potentially impacting thousands of developers.
Research
Security News
Socket researchers discovered a malware campaign on npm delivering the Skuld infostealer via typosquatted packages, exposing sensitive data.