
Research
Namastex.ai npm Packages Hit with TeamPCP-Style CanisterWorm Malware
Malicious Namastex.ai npm packages appear to replicate TeamPCP-style Canister Worm tradecraft, including exfiltration and self-propagation.
@brainhubeu/hadron-core
Advanced tools
Install Node.js. We recommend using the latest version, installation details on nodejs.org
Install following modules from npm:
npm install @brainhubeu/hadron-core @brainhubeu/hadron-express express --save
Let's start with traditional Hello World app. It will give you a quick grasp of the framework.
const hadron = require('@brainhubeu/hadron-core').default;
const express = require('express');
const port = 8080;
const expressApp = express();
const config = {
routes: {
helloWorldRoute: {
path: '/',
callback: () => 'Hello world!',
methods: ['get'],
},
},
};
hadron(expressApp, [require('@brainhubeu/hadron-express')], config).then(() => {
expressApp.listen(port, () =>
console.log(`Listening on http://localhost:${port}`),
);
});
In the sections below, we will describe step by step what just happened.
The main hadron-core function is responsible for bootstrapping the app. It registers packages based on passed config and server instance:
const hadron = require('hadron-core').default;
hadron(serverInstance, [...packages], config);
The purpose of the main function is to initialize DI container and register package dependencies according to correspondent sections in config object (described in details in next chapters).
Main function returns a promise that resolves to created DI container instance. In the promise .then() method, besides performing operations on the container instance, we can actually start our server, by calling Express listen method:
hadron(serverInstance, ...rest).then((container) => {
// do some things on container...
serverInstance.listen(PORT, callback);
});
Now, let's move to DI container itself.
The whole framework is built around DI Container concept. Its purpose is to automatically supply proper arguments for routes callbacks and other framework's building blocks.
DI container instance is created and used internally by bootstrapping function, it is also returned (as a promise) from bootstrapping function, as mentioned in the previous section.
container.register(key, item, lifetime);
key - item name on which it will be registered inside the containeritem - any value (primitive, data structure, function, class, etc.)lifetime - the type of item's life-spanLifetime options:
'value' - container returns registered item as is [default]'singleton' - returns always the same instance of registered class / constructor function'transient' - returns always a new instance of registered class / constructor functioncontainer.take(key);
key - item name (same as provided during registration)The method returns item or item instance according to item type and lifetime option.
const { default: hadron, Lifetime } = require('hadron-core');
hadron(...args).then((container) => {
container.register('foo', 123);
container.register('bar', class Bar {}, Lifetime.Singleton);
container.register('baz', class Baz {}, Lifetime.Transient);
// other stuff...
});
To access container items from callbacks, you can just set arguments' names to match container keys, and required dependency will be provided.
See an example here
FAQs
Hadron core module
We found that @brainhubeu/hadron-core demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 5 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Malicious Namastex.ai npm packages appear to replicate TeamPCP-style Canister Worm tradecraft, including exfiltration and self-propagation.

Product
Explore exportable charts for vulnerabilities, dependencies, and usage with Reports, Socket’s new extensible reporting framework.

Product
Socket for Jira lets teams turn alerts into Jira tickets with manual creation, automated ticketing rules, and two-way sync.