
Security News
/Research
Wallet-Draining npm Package Impersonates Nodemailer to Hijack Crypto Transactions
Malicious npm package impersonates Nodemailer and drains wallets by hijacking crypto transactions across multiple blockchains.
@digicatapult/wasp-payload-processor
Advanced tools
Service builder for WASP payload processors. The library provides a simple way of implementing a payload processor for a new thing type in WASP. The intentions of this module is to simplify the development of support for new IoT devices in WASP.
If developing a new payload parsing service for WASP this could be as simple as:
// server.js
import { buildService } from '@digicatapult/wasp-payload-processor'
buildService({
sensorType: 'new-sensor-type',
payloadProcessor: ({ logger }) => ({ thingId, timestamp, payload }) => {
const asBuffer = Buffer.from(payload, 'base64')
return {
readings: [{
dataset: {
thingId,
type: 'temperature',
label: 'dataset-label-if-any',
unit: '°C',
},
timestamp,
value: asBuffer[0],
}]),
events: [{
thingId,
timestamp,
type: 'SHOCK',
details: { arbitrary: "details" }
}]
},
})
The format of the outgoing message format is described below
The payloadProcessor
function must return an object of type PayloadProcessorResult
which contains descriptions of readings and events to be published. The type signatures are as follows:
type Event = {
thingId: uuid
type: string
timestamp: string
details: Object
}
type Dataset = {
thingId: uuid
type: string
label: string
unit: string
}
type DatasetPoint = {
dataset: Dataset
timestamp: string
value: number
}
type PayloadProcessorResult = {
readings: DatasetPoint[]
events: Event[]
}
Each of the DatasetPoint
values represents a single value at a point in time for the dataset defined by the thingId
, type
, label
and unit
. Here the thingId
is the uuid of the IoT device that generated the reading, type
is the type of the dataset e.g. temperature
and label
is an arbitrary label
to distinguish datasets when a thing may generate multiple datasets of the same type e.g. MCU temperature vs external temperature.
Each of the Event
values represents an event reported by a thingId
, which is then characterised by an event type
and a timestamp
at which the event occurred. An arbitrary details
property allows the event to convey additional information about the event.
First install required dependencies using npm
:
npm install
wasp-payload-processor
depends on Kafka
which can be brought up locally using docker:
docker-compose up -d
And finally you can run tests with:
npm test
wasp-payload-processor
is configured primarily using environment variables as follows:
variable | required | default | description |
---|---|---|---|
PORT | N | 3000 | Port on which the service will listen |
LOG_LEVEL | N | info | Logging level. Valid values are [trace , debug , info , warn , error , fatal ] |
KAFKA_LOG_LEVEL | N | nothing | Logging level for Kafka. Valid values are [debug , info , warn , error , nothing ] |
KAFKA_BROKERS | N | localhost:9092 | List of addresses for the Kafka brokers |
KAFKA_READINGS_TOPIC | N | readings | Outgoing Kafka topic for readings |
KAFKA_EVENTS_TOPIC | N | events | Outgoing Kafka topic for events |
KAFKA_PAYLOAD_ROUTING_PREFIX | N | payloads | Prefix for incoming Kafka topics for payloads |
FAQs
Service builder for WASP payload processors
The npm package @digicatapult/wasp-payload-processor receives a total of 10 weekly downloads. As such, @digicatapult/wasp-payload-processor popularity was classified as not popular.
We found that @digicatapult/wasp-payload-processor demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 5 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
/Research
Malicious npm package impersonates Nodemailer and drains wallets by hijacking crypto transactions across multiple blockchains.
Security News
This episode explores the hard problem of reachability analysis, from static analysis limits to handling dynamic languages and massive dependency trees.
Security News
/Research
Malicious Nx npm versions stole secrets and wallet info using AI CLI tools; Socket’s AI scanner detected the supply chain attack and flagged the malware.