
Security News
/Research
Wallet-Draining npm Package Impersonates Nodemailer to Hijack Crypto Transactions
Malicious npm package impersonates Nodemailer and drains wallets by hijacking crypto transactions across multiple blockchains.
@artsy/express-reloadable
Advanced tools
Development tool that enables hot-swapping Express server code without a restart
When developing a Node app it's common to rely on tools like node-dev
or nodemon
to make the development process more rapid by automatically restarting the server instance on file-change. What express-reloadable
does is listen for source-code changes within a subset of your app and, scanning Node's internal module cache, clears the require
call if found. This tricks Node into thinking the module has not yet been loaded, effectively hot-swapping out your code without a full restart. Additionally, when the watchModules
option is passed, express-reloadable
will listen for changes to NPM module code and reload on change. Useful when working with yarn link
across packages / repos. Crazy-fast development speed!
Disclaimer: While this works for most of our use-cases, this is an example of "
require hacking"
and hasn't been tested in all environments. Your mileage may vary.
How it works:
express-reloadable
is called with a path to an app, which it then mountsrequire
cache for the changed filedelete require.cache[id]
express-reloadable
executes a callback that re-requires the code and changes are instantly available.Installation:
yarn add @artsy/express-reloadable
Example:
The below example assumes that the folders /api
and /client
exist, and that each contain an index file that exports a mountable express.js route.
import express from 'express'
import { createReloadable, isDevelopment } from '@artsy/express-reloadable'
const app = express()
if (isDevelopment) {
// Pass in `app` and current `require` context
const mountAndReload = createReloadable(app, require)
// Pass in the path to an express sub-app and everything is taken care of
mountAndReload(path.resolve(__dirname, './client'))
// Full example:
app.use('/api', mountAndReload(path.resolve(__dirname, './api')), {
// If you need to mount an app at a particular root (`/api`), pass in
// `mountPoint` as an option.
mountPoint: '/api',
// Or if you're using `yarn link` (or npm) to symlink external dependencies
// during dev, pass in an array of modules to watch. Changes made internally
// will be instantly available in the app. Additionally, using something like
// `glob`, other modules outside of express route path can be passed.
watchModules: [
'@artsy/reaction',
'@artsy/artsy-xapp'
]
}))
// If prod, mount apps like normal
} else {
app.use('/api', require('./api')
app.use(require('./client')
}
app.listen(3000, () => {
console.log(`Listening on port 3000`)
})
Troubleshooting:
Help! I've mounted my app using reloadable but I'm not seeing any changes?
For the utility to work you need to a) ensure that NODE_ENV=development
(for safety) and b) the path to your app is absolute:
// Incorrect
app.use(reloadAndMount('./path/to/app'))
// Correct
app.use(reloadAndMount(path.resolve(__dirname, 'path/to/app')))
Thanks:
This package was heavily inspired by @glenjamin's ultimate-hot-loading-example.
FAQs
Development tool that enables hot-swapping Express server code without a restart
The npm package @artsy/express-reloadable receives a total of 1,293 weekly downloads. As such, @artsy/express-reloadable popularity was classified as popular.
We found that @artsy/express-reloadable demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 14 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
/Research
Malicious npm package impersonates Nodemailer and drains wallets by hijacking crypto transactions across multiple blockchains.
Security News
This episode explores the hard problem of reachability analysis, from static analysis limits to handling dynamic languages and massive dependency trees.
Security News
/Research
Malicious Nx npm versions stole secrets and wallet info using AI CLI tools; Socket’s AI scanner detected the supply chain attack and flagged the malware.