
Research
Security News
Malicious PyPI Package Exploits Deezer API for Coordinated Music Piracy
Socket researchers uncovered a malicious PyPI package exploiting Deezer’s API to enable coordinated music piracy through API abuse and C2 server control.
@cardstack/hub
Advanced tools
The Cardstack Hub is the API server for the Cardstack project. For more information, see the project-wide README.
The Hub consists of API endpoints and a postgres database.
The app uses a Postgresql-based background task queue built on graphile/worker
Below is a list of the most common environment variables that the Hub accepts:
HUB_AWS_ACCESS_KEY_ID
HUB_AWS_SECRET_ACCESS_KEY
HUB_AWS_REGION
AWS_PROFILE
- if none of the HUB_AWS_* variables are defined, no credentials or region will be passed to the aws-sdk. This will make the aws-sdk's default behavior take effect, which includes using an AWS_PROFILE env var if it is setSERVER_SECRET
(required) - to generate one for your machine, run node --eval="console.log(crypto.randomBytes(32).toString('base64'))"
DATABASE_URL
- defaults in development to postgres://postgres:postgres@localhost:5432/hub_developmentLOG_LEVELS
- defaults to *=info
Search the mono-repo for process.env
and check the config directory to see these variables referenced.
To use the variables, create a file named .env
in the hub's folder, and put in the variables you want to use.
For example:
SERVER_SECRET=7TmgY1xFo/WrYTnAFSvAemZtFB8wQVMd8IkoeQKBboE=
AWS_PROFILE=cardstack
The following command will create a hub_development database on your locally running postgres server, run migrations, and load seed data. It will then create a hub_test database, and clone the structure of the development database to it.
bin/hub db setup
Load the database with seed data
bin/hub db seed
# Starts the server on port 300
bin/hub server
# Starts the worker process
bin/hub worker
# If you want to run both in the same terminal you can run
yarn start
# Run available migrations
yarn db:migrate up
#To reverse the last migration:
yarn db:migrate down
#To redo the last migration (i.e. down + up):
yarn db:migrate redo
## Creating database migrations
yarn db:migrate create <migration-name>`
Documentation on how to create migration scripts is available at https://salsita.github.io/node-pg-migrate/#/migrations
After you have completed running your new DB migration script create a pg_dump of the DB in the config/structure.sql
file using:
bin/hub db dump
To test, debug and call isolated parts of the application within its context.
bin/hub console
starts the application console.
Examples:
Hub > const { Client } = require('pg');
Hub > const config = require('config');
Hub > const client = new Client(config.db.url);
Hub > await client.connect();
Hub > await client.query('SELECT * FROM merchant_infos');
Hub > const workerClient = await container.lookup('worker-client');
Hub > await workerClient.addJob('persist-off-chain-merchant-info', { id: 1 });
Add the following to your ~/.ssh/config
file:
# SSH over Session Manager
host i-* mi-*
ProxyCommand sh -c "aws ssm start-session --target %h --document-name AWS-StartSSHSession --parameters 'portNumber=%p'"
Lookup the tunneling command and database password:
cd [PROJECTS]/cardstack/infra/configs/hub/[staging|production]
AWS_PROFILE=cardstack terraform output | grep tunnel_to_database
AWS_PROFILE=cardstack terraform output | grep postgres_password
Run the command, open a postgres client, and connect to localhost, port 55432 with username cardstack, password as looked up in previous step.
APIs conform to the JSON API specification.
The hub CLI can be invoked from within the hub package
bin/hub
💡 Tip: Add export PATH="./bin:$PATH"
to your .zshenv
or .bash_profile
to be to invoke hub
directly (without the bin/
)
The files that support the CLI are in the cli/
directory. You can add your own by following these instructions. The full yargs
api can be found here.
Note that this package is written in TypeScript, so be sure to run a TypesScript compiler as you work. See the project-wide README for information about running the Hub and its tests locally.
FAQs
Stock API server for the Cardstack tech stack.
The npm package @cardstack/hub receives a total of 302 weekly downloads. As such, @cardstack/hub popularity was classified as not popular.
We found that @cardstack/hub demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 8 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket researchers uncovered a malicious PyPI package exploiting Deezer’s API to enable coordinated music piracy through API abuse and C2 server control.
Research
The Socket Research Team discovered a malicious npm package, '@ton-wallet/create', stealing cryptocurrency wallet keys from developers and users in the TON ecosystem.
Security News
Newly introduced telemetry in devenv 1.4 sparked a backlash over privacy concerns, leading to the removal of its AI-powered feature after strong community pushback.