
Research
Malicious npm Packages Impersonate Flashbots SDKs, Targeting Ethereum Wallet Credentials
Four npm packages disguised as cryptographic tools steal developer credentials and send them to attacker-controlled Telegram infrastructure.
@baethon/udba-bootstrap
Advanced tools
Very basic, very minimal application bootstrap layer. Use it when you need to have a control over application set up (and later shutdown) process.
First, install the package.
npm i @baethon/udba-bootstrap
Setup the bootstrap module (bootstrap/index.js
)
const { Bootstrap } = require('@baethon/udba-bootstrap')
module.exports = new Bootstrap(`${__dirname}/providers`)
Bootstrap the application in the applications main file (e.g. the express server)
const bootstrap = require('./boostrap')
bootstrap.load()
.then(() => {
// application was bootstrapped, here you can place the main logic etc
})
If your application handles SIGTERM
signal (or other shutdown handler) you should add.
process.on('SIGTERM', async () => {
await bootstrap.shutdown()
})
A provider is a class that is reponsible for preparing some core parts of the application before they can be used in the app. Think of it as as a startup script.
Provider can be sorts of things:
script setting up connection with the database (e.g. Sequelize init script)
configuration loader
external integration set up
Providers can have a priority. It's part of their name (e.g. 1-sequelize.js
). Bootstrap will make sure to load providers in correct order, using their prority. The lower the number, the higher the priority. The default priority of the provider (in case when you missed adding it in the file name) is 99
.
const mongoose = require('mongoose');
class MongoProvider {
async setup () {
const baseOptions = {
useNewUrlParser: true,
useCreateIndex: true,
user: process.env.MONGODB_USER,
pass: process.env.MONGODB_PASS,
};
await mongoose.connect(process.env.MONGODB_URL, baseOptions)
}
async shutdown () {
await mongoose.disconnect();
}
}
module.exports = MongoProvider
Bootstrap assumes that all providers are listed in a single directory. You can define this directory in the Bootstrap
constructor argument. Providers of the same priority will be loaded concurrently.
Example files structure can look like this:
bootstrap
|- providers
|- 1-config.js
|- 2-mongodb.js
|- 10-middleware.js
|- 10-logging.js
@baethon/udba-bootstrap
Quite often I've been working with the applications that don't use any specific framework (disclaimer: I don't consider express
or hapi
to be a fully fledged framework). They tend to have a single server.js
file which tries to do many things:
set up core modules (database, config etc)
load the routes
start the server instance
Usually, this works.
Quite often I had to add a new application layer that required similar loading process, yet without the server parts (e.g. CLI scripts). This requires extracting the loading scripts to a separate module, so that it can be re-used. Quite often it's a single file, doing many things. It becomes a blob which can be hard to maintain.
@baethon/udba-bootstrap
gives a clear separation of concerns. Each provider handles the process of setting up only a single core part of the application. With the priorities one can controll the order of their initialization. Adding new startup scripts shouldn't be any problem.
npm test
FAQs
Minimalistic application bootstrapping layer
The npm package @baethon/udba-bootstrap receives a total of 3 weekly downloads. As such, @baethon/udba-bootstrap popularity was classified as not popular.
We found that @baethon/udba-bootstrap demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Four npm packages disguised as cryptographic tools steal developer credentials and send them to attacker-controlled Telegram infrastructure.
Security News
Ruby maintainers from Bundler and rbenv teams are building rv to bring Python uv's speed and unified tooling approach to Ruby development.
Security News
Following last week’s supply chain attack, Nx published findings on the GitHub Actions exploit and moved npm publishing to Trusted Publishers.