
Research
/Security News
9 Malicious NuGet Packages Deliver Time-Delayed Destructive Payloads
Socket researchers discovered nine malicious NuGet packages that use time-delayed payloads to crash applications and corrupt industrial control systems.
Conductor is an event sourced architecture orchestrator that uses PostgreSQL (or any other database that satisfies the interfaces) as its event store. It abstracts away the complex plumbing typically required to implement event sourcing in Go for single-instance, clustered, or distributed deployments.
I was designing a typical small to medium size CRUD application around a PostgreSQL database with rather low write-throughput but strong consistentcy requirements, email notifications and an audit log. Event sourcing felt like a natural fit. Yet, I didn't want to introduce a complex and heavy Kafka setup, or similar. It would only need to scale to maybe a couple instances at most. Simplicity and reliability were my highest priority.
I created this package to abstract away most of the complex moving parts when implementing an event sourced architecture in Go and PostgreSQL, but in a way that doesn't prevent you from using other databases.
There are 3 types of middleware modules that can plug into a Conductor instance:
| module | setup | consistency |
|---|---|---|
| StatefulProcessor | 👤 single | strong |
| StatefulProcessor | 👥 cluster | eventual |
| StatelessProcessor | 👤 single | strong |
| StatelessProcessor | 👥 cluster | strong |
| Reactor | 👤 single | eventual |
| Reactor | 👥 cluster | eventual |
In a cluster setup the instances are synchronized by:
dbpgx it's the LISTEN on event_inserted notification)
OCC (Optimistic Concurrency Control) is utilized to keep cluster instances of the Conductor synchronized. When Conductor instances try to append a new event they also send the assumed current version. If the assumed version is behind the actual system version then the projections are synchronized and the entire append procedure is retried until the version matches on append.
The database is abstracted through interfaces and a PostgreSQL implementation is provided
in the db/dbpgx package. These interfaces can be satisfied with implementations based
on most transactional databases.
dbpgxdbpgx satisfies the database interfaces using the SQL driver
github.com/jackc/pgx/v5 and is tested with
PostgreSQL 17.
To migrate a PostgreSQL database for dbpgx to use, do in the given order:
db/dbpgx/roles.sql to create global database roles.db/dbpgx/system.sql to create the tables and notification trigger.db/dbpgx/permissions.sql sets the role permissions.You may customize roles and permissions, the defaults here are just a recommendation.
Use make test to run the linters, checks, and tests.
FAQs
Unknown package
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Socket researchers discovered nine malicious NuGet packages that use time-delayed payloads to crash applications and corrupt industrial control systems.

Security News
Socket CTO Ahmad Nassri discusses why supply chain attacks now target developer machines and what AI means for the future of enterprise security.

Security News
Learn the essential steps every developer should take to stay secure on npm and reduce exposure to supply chain attacks.