
Research
Security News
Lazarus Strikes npm Again with New Wave of Malicious Packages
The Socket Research Team has discovered six new malicious npm packages linked to North Korea’s Lazarus Group, designed to steal credentials and deploy backdoors.
@carforyou/cookies
Advanced tools
Cookies package for setting and reading our cookies
npm install @carforyou/cookies
This package exports multiple functions needed for handling both server-side and client-side cookies in Next.js projects.
Server-side cookies can be created by passing { req, res } context to the withCookies
function:
import { withCookies } from "@carforyou/cookies"
const { setCookie } = withCookies({ req, res }) // pass the ctx object
setCookie(name, value, options)
By passing the context to withCookies, internally, in the setCookie
function,
an api call to api/cookies
is made where our setServerSideCookie
function
is defined. setServerSideCookies
sets the cookie and returns a status code
of 201 if the cookie pattern matches to the one specified. Otherwise,
it returns a 400 status code.
Configuring the api:
pages/api/cookies.ts
import { setServerSideCookie } from "@carforyou/cookies"
const cookieHandler = (req, res) => {
try {
setServerSideCookie(req, res)
} catch (err) {
import("~/lib/sentry").then((module) => {
const Sentry = module.default
Sentry.captureException("Failed persisting client-side cookie", {
extra: { err },
})
})
}
}
export default cookieHandler
Client-side cookies can be set by not passing a { req, res } context
to the withCookies
function.
import { withCookies } from "@carforyou/cookies"
const { getCookie, setCookie } = withCookies() // no arguments passed
const myCookie = getCookie("cookieName")
npm run build
You can link your local npm package to integrate it with any local project:
cd carforyou-cookies-pkg
npm run build
cd carforyou-listings-web
npm link ../carforyou-cookies-pkg/pkg
New versions are released on the ci using semantic-release as soon as you merge into master. Please make sure your merge commit message adheres to the corresponding conventions.
FAQs
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
The Socket Research Team has discovered six new malicious npm packages linked to North Korea’s Lazarus Group, designed to steal credentials and deploy backdoors.
Security News
Socket CEO Feross Aboukhadijeh discusses the open web, open source security, and how Socket tackles software supply chain attacks on The Pair Program podcast.
Security News
Opengrep continues building momentum with the alpha release of its Playground tool, demonstrating the project's rapid evolution just two months after its initial launch.