
Research
Malicious npm Packages Impersonate Flashbots SDKs, Targeting Ethereum Wallet Credentials
Four npm packages disguised as cryptographic tools steal developer credentials and send them to attacker-controlled Telegram infrastructure.
@arcaelas/dynamite
Advanced tools
 
A decorator‑first, zero‑boilerplate ORM for DynamoDB (AWS SDK v3).
Auto‑provisions tables · Runs anywhere Node.js runs · Written in TypeScript only
npm i @arcaelas/dinamite
# peer deps (unless already installed)
npm i @aws-sdk/client-dynamodb @aws-sdk/util-dynamodb pluralize
import {
connect,
Table,
Index, // PK
CreatedAt,
UpdatedAt,
Default,
} from "@arcaelas/dinamite";
connect({
region: "us-east-1",
// DynamoDB Local example
endpoint: "http://localhost:7007",
credentials: { accessKeyId: "x", secretAccessKey: "x" },
});
class User extends Table {
@Index() // Partition Key
declare id: string;
@Default(() => "")
declare name: string;
@CreatedAt() // ISO‑string timestamp
declare created: string;
@UpdatedAt()
declare updated: string;
}
const bob = await User.create({ id: "u1", name: "Bob" });
bob.name = "Robert";
await bob.save(); // upsert
console.log(await User.where());
await bob.destroy();
First call auto‑creates a table users
(user
→ snake + plural).
Decorator | Purpose | Extras |
---|---|---|
@Index() | Partition key. Exactly one «PK» per model. | |
@IndexSort() | Sort key. Requires previous @Index() . | |
@PrimaryKey() | Shortcut: PK + SK on same property. | |
@Default(fn) | Lazy default value, evaluated once per instance. | |
@Mutate(fn) | Sequential value transformer. Runs before validators. | |
@Validate(fn\[]) | Sync validator(s); return true or error string . | |
@NotNull() | Built‑in not‑null / not‑empty validation. | |
@CreatedAt() | Timestamp (ISO) on first assignment. | |
@UpdatedAt() | Timestamp (ISO) every assignment. | |
@Name("alias") | Override table or column name. |
Execution order: Default → Mutate[] → Validate[]
User.create(data); // PutItem (auto‑table‑creation)
User.update(id, patch); // PutItem replacement
User.destroy(id); // DeleteItem
User.where(); // Scan → User[]
const u = new User({ id: "42", name: "Neo" });
await u.save(); // inserts
u.name = "The One";
await u.save(); // updates
await u.update({ name: "Thomas" });
await u.destroy();
model.toJSON()
→ only fields declared via decorators are included.
Undefined values are stripped before marshall()
(removeUndefinedValues
).
connect({
region: "…",
endpoint: "https://…", // optional – for DynamoDB Local
credentials: {
accessKeyId: "…",
secretAccessKey: "…",
},
});
PascalCase
/ camelCase
→ snake_case
pluralize
Override with @Name("my_table")
.
docker run -p 7007:8000 amazon/dynamodb-local
type Inmutable = string | number | boolean | null | object;
type Mutate = (value: any) => Inmutable;
type Default = Inmutable | (() => Inmutable);
type Validate = (value: any) => true | string;
interface Column {
name: string;
default?: Default;
mutate?: Mutate[];
validate?: Validate[];
index?: true; // PK
indexSort?: true; // SK
unique?: true; // not yet enforced
}
interface WrapperEntry {
name: string; // physical table
columns: Map<string | symbol, Column>; // property → Column
}
Internal state lives in src/core/wrapper.ts
.
class Post extends Table {
@Index() declare id: string;
@Default(() => false) declare deleted: boolean;
async softDelete() {
this.deleted = true;
await this.save();
}
}
import { Mutate } from "@arcaelas/dinamite";
const lower: Mutate = (v) => String(v).toLowerCase();
class Subscriber extends Table {
@Index() declare id: string;
@Mutate(lower) declare email: string;
}
Because tables are created at runtime you can safely deploy stacks without resources
, then subscribe Lambdas to the physical table names emitted by Dinamite (User
→ users
, unless overridden).
Error | Explanation & fix |
---|---|
Metadata no encontrada | Model file imported before decorators executed – avoid circular imports; ensure connect() runs first. |
PartitionKey faltante | No @Index() in the model. Add one. |
Two keys can not have the same name | PK & SK attribute clash. Use @PrimaryKey() or distinct column names. |
UnrecognizedClientException | Wrong credentials / DynamoDB Local not running. |
feat:
, fix:
…).yarn test
must pass (Jest + ESLint).Made with ❤️ by Miguel Alejandro – MIT License.
FAQs
 
The npm package @arcaelas/dynamite receives a total of 128 weekly downloads. As such, @arcaelas/dynamite popularity was classified as not popular.
We found that @arcaelas/dynamite demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Four npm packages disguised as cryptographic tools steal developer credentials and send them to attacker-controlled Telegram infrastructure.
Security News
Ruby maintainers from Bundler and rbenv teams are building rv to bring Python uv's speed and unified tooling approach to Ruby development.
Security News
Following last week’s supply chain attack, Nx published findings on the GitHub Actions exploit and moved npm publishing to Trusted Publishers.