
Security News
/Research
Wallet-Draining npm Package Impersonates Nodemailer to Hijack Crypto Transactions
Malicious npm package impersonates Nodemailer and drains wallets by hijacking crypto transactions across multiple blockchains.
@cumulus/cumulus-message-adapter-js
Advanced tools
Cumulus is a cloud-based data ingest, archive, distribution and management prototype for NASA's future Earth science data streams.
Read the Cumulus Documentation
The Cumulus Message Adapter is a library that adapts incoming messages in the Cumulus protocol to a format more easily consumable by Cumulus tasks, invokes the tasks, and then adapts their response back to the Cumulus message protocol to be sent to the next task.
The cumulus-message-adapter-js can be installed via Node Package Manager (NPM) and the package is located here.
The package can be added to your project by running npm install @cumulus/cumulus-message-adapter-js --save
.
In order to use the Cumulus Message Adapter, you will need to create two methods in your task module: a handler function and a business logic function.
The handler function is a standard Lambda handler function which takes three
parameters (as specified by AWS): event
, context
, and callback
.
The business logic function is where the actual work of your task occurs. It
should take two parameters: nestedEvent
and context
.
The nestedEvent
object contains two keys:
input
- the task's input, typically the payload
of the message,
produced at runtimeconfig
- the task's configuration, with any templated variables
resolvedThe context
parameter is the standard Lambda context as passed by AWS.
The return value of the business logic function will be placed in the
payload
of the resulting Cumulus message.
Expectations for input, config, and return values are all defined by the task, and should be well documented. Tasks should thoughtfully consider their inputs and return values, as breaking changes may have cascading effects on tasks throughout a workflow. Configuration changes are slightly less impactful, but must be communicated to those using the task.
The Cumulus Message adapter for Javascript provides one method:
runCumulusTask
. It takes four parameters:
taskFunction
- the function containing your business logic (as described
above)cumulusMessage
- the event passed by Lambda, and should be a Cumulus
Messagecontext
- the Lambda contextcallback
- the callback passed by Lambdaconst cumulusMessageAdapter = require('@cumulus/cumulus-message-adapter-js');
function myBusinessLogic(nestedEvent, context) {
console.log('Hello, example!');
return { answer: 42 };
}
// The handler function should rarely, if ever, contain more than this line
function handler(event, context, callback) {
cumulusMessageAdapter.runCumulusTask(myBusinessLogic, event, callback);
}
exports.handler = handler;
Tasks that use this library are just standard AWS Lambda tasks. Information on creating release packages is available here.
During deployment, Cumulus will automatically obtain and inject the Cumulus Message Adapter into the compiled code and create a zip file to be deployed to Lambda.
A task using the message adapter would be configured in lambdas.yml as follows:
NodeTest:
handler: index.handler
timeout: 300
memory: 256
source: 'node_modules/@cumulus/task-task/dist/'
useMessageAdapter: true
To run the tests for this package, run npm test
This approach has a few major advantages:
meta
and cumulus_meta
that are owned internally and may therefore
be broken in future updates. To gain access to fields in these structures,
tasks must be passed the data explicitly in the workflow configuration.meta
. Cumulus owns cumulus_meta
. Tasks define their own config
,
input
, and output
formats.FAQs
Cumulus message adapter
The npm package @cumulus/cumulus-message-adapter-js receives a total of 10 weekly downloads. As such, @cumulus/cumulus-message-adapter-js popularity was classified as not popular.
We found that @cumulus/cumulus-message-adapter-js demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 5 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
/Research
Malicious npm package impersonates Nodemailer and drains wallets by hijacking crypto transactions across multiple blockchains.
Security News
This episode explores the hard problem of reachability analysis, from static analysis limits to handling dynamic languages and massive dependency trees.
Security News
/Research
Malicious Nx npm versions stole secrets and wallet info using AI CLI tools; Socket’s AI scanner detected the supply chain attack and flagged the malware.