
Research
PyPI Package Disguised as Instagram Growth Tool Harvests User Credentials
A deceptive PyPI package posing as an Instagram growth tool collects user credentials and sends them to third-party bot services.
@canvas-js/cli
Advanced tools
Canvas provides a command line interface for running applications in Node.js, that join the peer-to-peer network.
Canvas provides a command line interface for running applications in Node.js, that join the peer-to-peer network.
To install the CLI, run:
npm install -g @canvas-js/cli
canvas <command>
Commands:
canvas init <path> Initialize a new application
canvas info <path> Show the model schema and action names in a contract
canvas run <path> Run a Canvas application
canvas export <path> Export the action log as dag-json to stdout
canvas import <path> Import an action log from stdin
Options:
--version Show version number
--help Show help
The main command is canvas run <path>
. This will start a libp2p node, SQLite database, QuickJS VM for processing actions, and an HTTP API server.
By default, canvas run contract.ts
will run a contract with ephemeral storage persistence.
For persistence, you should provide a data directory like canvas run data/myapp --init contract.ts
to save the message log and model database to disk. You only need to provide the --init argument the first time when setting up the data directory.
Use the --help
flag to learn more.
In the likely case that your machine is behind a NAT layer, you have to provide the CLI with both an internal port bind a WebSocket server using the --listen
option, and a public external address using the --announce
option. Both of these must be formatted as multiaddrs, the generic composable network address format used by libp2p.
For example, this tells the CLI to listen on port 4444 and advertise wss://foobar.com:8000
as the public address:
$ canvas run ./myapp --listen /ip4/0.0.0.0/tcp/4444/ws --announce /dns4/foobar.com/tcp/443/wss
This assumes that you've configured your server to handle incoming secure websocket connections over TLS on port 443
, do TLS termination, and proxy the connection to your internal port 4444
.
A few things to note:
--announce
addresses as you want, but only one --listen
address./ip4/{publicIP}/tcp/{port}/wss
.AAAA
records, you can use /dns6
in addition to /dns4
.--listen
address without an --announce
address to delegate to libp2p's autonat and identify services, which are works in progress. It's best to provide a public address if you have one.Almost always, --listen
will be of the form /ip4/0.0.0.0/tcp/${port}/ws
, and --announce
will be of the form /dns4/${hostname}/tcp/{port}/wss
.
Running a Canvas app with canvas run
will serve an HTTP API at http://127.0.0.1:8000/api/
by default. You can change the port with the --port
option.
The basic routes are:
GET /api
- get application metadataGET /api/models/:model
- get model recordsGET /api/models/:model/:key
- get a model record by primary keyGET /api/clock
- get the next logical clock value from the logGET /api/messages
- query ranges of log messagesGET /api/messages/:id
- get a message from the logPOST /api/messages
- apply a signed messageGET /api/connections
- current libp2p connectionsGET /api/peers
- current libp2p pubsub peersPOST /api/ping/:peerId
- ping a peer via libp2pSome optional API endpoints are disabled by default, since they should't be exposed publicly.
--metrics
- serve Prometheus metrics at /metrics
The metrics reported to Prometheus include default NodeJS metric, internal libp2p metrics, and some additional metrics specific to Canvas Core
.
canvas_sync_time
A histogram of MST sync times.
label name | type |
---|---|
topic | string |
duration | number |
peer | string |
canvas_messages
A counter of messages applied
label name | type | description |
---|---|---|
topic | string | |
type | string | "action" or "session" |
--static [directory]
can be used to serve a static directory alongside the application API. This is the easiest way to bundle a frontend that uses Canvas as a backend. If the --static
flag is provided, the root path /
serves the files in [directory]
.
--network-explorer
serves an explorer for the model database and message log. If you're running the network explorer, you can also provide --admin <ethAddress>
to set an admin address that can upgrade the currently running contract in the CLI.
FAQs
Canvas provides a command line interface for running applications in Node.js, that join the peer-to-peer network.
The npm package @canvas-js/cli receives a total of 326 weekly downloads. As such, @canvas-js/cli popularity was classified as not popular.
We found that @canvas-js/cli demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 3 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
A deceptive PyPI package posing as an Instagram growth tool collects user credentials and sends them to third-party bot services.
Product
Socket now supports pylock.toml, enabling secure, reproducible Python builds with advanced scanning and full alignment with PEP 751's new standard.
Security News
Research
Socket uncovered two npm packages that register hidden HTTP endpoints to delete all files on command.