Research
Security News
Malicious npm Package Targets Solana Developers and Hijacks Funds
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
10tcl is a CRUD plugin that will add default routes to your express app, that read and store data in your mongodb.
It works! ...mostly. Right now I could not recommend it. Give it a few months before serious usage. It has some limitations and misconceptions, and it is not getting better soon.
$ npm install 10tcl
A config file must contain:
module.exports = {
// used as title for your pages
brand: 'Day of the Tentacle IS HERE!',
// used to assemble the connection string to your mongodb instance
db: {
usr: 'Purple',
pwd: 'Tentacle',
srv: 'ds044356.mongolab.com:49842',
db: 'day_of_the_tentacle',
par: 'auto_reconnect'
},
// static admin user to allow first login
admin: { usr: 'admin', pwd: 'ElGranSecreto', name: 'Admin', role: 'admin'}
// __dirname of your root
root: root,
// if not informed it defaults to 'root/models', 'root/controllers' and 'root/views'
pathToCtrls: '/app/controllers',
pathToModels: '/app/models',
pathToViews: '/app/views',
pathToValidator: 'app/models/validator'
}
// __dirname will be the root to locate folders indicated in pathTo... properties
var app = require('10tcl').attack(__dirname, '/config/yourConfigFile')
app.listen(yourPortHere)
10tcl attack results in an express app configured with routes based on your models and controllers.
app.db contains a connection to your database. It was done by using Mongoskin and the credentials on the config object.
Every .js file under your controllers folder was required, receiving (app, base, config).
An example of controller file would be:
module.exports = function(app, base, config){
function hello(req, res){
res.send('hello world')
}
app.get('/hello', base.auth, hello )
// will be used to create a menu
return {name: 'hello', label: 'Hello World'}
}
Every .js file under your models folder was required as well, no arguments. Each binded to app.db by the model.name property, so now app.db[modelNameHere] points to a collection capable of restfull crud.
An example of model would be:
module.exports = {
// model and db collection name
name: 'victims',
// Title for pages and menu
label: 'Victims',
// used with mustache to format list and drop down descriptions
format: 'Victim {{name}} {{lastName}}',
// fields to format and forms (see next topic)
fields: [
{ name: 'name', label: 'Nome', type: 'string', checks: ['hasValue'] },
{ name: 'lastName', label: 'Sobrenome', type: 'string' }
],
// create route '<your-site>.com/victims' pointing to 10tcl CRUD
routeTo10tcl: true,
// read the entire collection into the app, changes it before persisting
keepInCache: true,
// restrict access to users with one of these roles
onlyFor: ['admin'],
// used if you run 'node myApp.js mock'
mock: [
{name: 'Mussum', _id: '508e0077d42bd6182f000001'},
{name: 'Zacarias', _id: '508e0077d42bd6182f000002'},
{name: 'Dedé', lastname: 'Santana', _id: '508e0077d42bd6182f000003'},
{name: 'Didi', lastname: 'Mocó', _id: '508e0077d42bd6182f000004'}
]
}
10tcl understands: string, number, email, tel, date, html, text, reference (type: 'reference', to: 'criminal') Each will result in a different html element and layout. A field type different from the above will result in a regular input field.
10tcl modelValidator provides type associated checks, that are automatically executed on POST/PUT transactions. Other than that, a field can contain a property checks: ['hasValue', ...] Each string in checks array will trigger the correspondent function of the modelValidator. Defining pathToValidator, you can implement your own validator that will be required instead of the 10tcl one.
User and Profile are pre-loaded models that provide access control. The config property "admin" provides a proto user for the first login.
Nop... sorry. And I'm outputting static texts in PT-BR. Not happy with any package I've tried. Want to keep texts in a cached db for online editing and translation.
The views are made with bootstrap, jquery, and some home-made binding (Angular was just making me angry). In mobile they are much simpler, made with jquerymobile and jquery. The decision between mobile and desktop is made by reading request headers.
FAQs
CRUD over express and mongodb
The npm package 10tcl receives a total of 4 weekly downloads. As such, 10tcl popularity was classified as not popular.
We found that 10tcl demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
Security News
Research
Socket researchers have discovered malicious npm packages targeting crypto developers, stealing credentials and wallet data using spyware delivered through typosquats of popular cryptographic libraries.
Security News
Socket's package search now displays weekly downloads for npm packages, helping developers quickly assess popularity and make more informed decisions.