
Research
Malicious npm Packages Impersonate Flashbots SDKs, Targeting Ethereum Wallet Credentials
Four npm packages disguised as cryptographic tools steal developer credentials and send them to attacker-controlled Telegram infrastructure.
@discue/leaky-buckets
Advanced tools
Porro is a simple and fast implementation of the leaky bucket algorithm.
During a scene in Cloudy with a Chance of Meatballs 2, the protagonists are moving with a boat. At some point, a wild tribe of living leeks attacks the boat, and the scientist shouts: "There's a leak in the boat!". Porro means leek in Italian. Leaky bucket algorithm -> Leak -> Leek -> Porro.
import
/export
.Open your favourite shell and run:
npm install porro
new Porro(options)
Porro's constructor
.
options
<Object>
<Number>
The size (number of tokens) of the bucket.<Number>
Time interval in milliseconds to refill the bucket.<Number>
Number of refilled tokens after the specified interval.<Porro>
Porro::tokens
Returns (getter) the current number of tokens inside the bucket.
<Number>
Porro::request([quantity])
Returns the amount of time that the pending request needs to wait before executing.
[quantity]
<Number>
Number (positive integer) of tokens to burn for the current request. Defaults to 1
.<Number>
Porro::throttle([quantity])
Returns a Promise
that will resolve when It's appropriate to execute the pending request.
[quantity]
<Number>
Number (positive integer) of tokens to burn for the current request. Defaults to 1
.<Promise>
Resolves with the waited milliseconds.Porro::reset()
Resets the bucket to its original status.
import { Porro } from 'porro'
// 2 requests per second with a "buffer" of 5 requests
const bucket = new Porro({
bucketSize: 5,
interval: 1000,
tokensPerInterval: 2
})
async function run () {
// Create 10 "requests"
const items = new Array(10).fill(null)
// Execute all requests at the same time
log('script is starting')
await Promise.all(items.map(doSomething))
}
async function doSomething (value, index) {
// Get the waiting time for the currenct request
const ms = bucket.request()
// Sleep for the required time
// You can also use `await bucket.throttle()` for simplicity
if (ms > 0) {
log(`request #${index} will wait ${ms}ms`)
await sleep(ms)
}
// Do something!
log(`run request #${index}`)
}
function log (message) {
console.log(`[${new Date().toISOString()}]`, message, `(bucket has now ${bucket.tokens} tokens)`)
}
function sleep (ms) {
return new Promise(resolve => setTimeout(resolve, ms))
}
run()
// [2023-01-27T14:21:13.776Z] script is starting (bucket has now 5 tokens)
// [2023-01-27T14:21:13.779Z] run request #0 (bucket has now 4 tokens)
// [2023-01-27T14:21:13.779Z] run request #1 (bucket has now 3 tokens)
// [2023-01-27T14:21:13.779Z] run request #2 (bucket has now 2 tokens)
// [2023-01-27T14:21:13.779Z] run request #3 (bucket has now 1 tokens)
// [2023-01-27T14:21:13.779Z] run request #4 (bucket has now 0 tokens)
// [2023-01-27T14:21:13.779Z] request #5 will wait 1000ms (bucket has now -1 tokens)
// [2023-01-27T14:21:13.779Z] request #6 will wait 1000ms (bucket has now -2 tokens)
// [2023-01-27T14:21:13.779Z] request #7 will wait 2000ms (bucket has now -3 tokens)
// [2023-01-27T14:21:13.780Z] request #8 will wait 2000ms (bucket has now -4 tokens)
// [2023-01-27T14:21:13.780Z] request #9 will wait 3000ms (bucket has now -5 tokens)
// [2023-01-27T14:21:14.782Z] run request #5 (bucket has now -3 tokens)
// [2023-01-27T14:21:14.782Z] run request #6 (bucket has now -3 tokens)
// [2023-01-27T14:21:15.779Z] run request #7 (bucket has now -1 tokens)
// [2023-01-27T14:21:15.780Z] run request #8 (bucket has now -1 tokens)
// [2023-01-27T14:21:16.782Z] run request #9 (bucket has now 1 tokens)
FAQs
Fast leaky bucket algorithm implementation without timers
We found that @discue/leaky-buckets demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Four npm packages disguised as cryptographic tools steal developer credentials and send them to attacker-controlled Telegram infrastructure.
Security News
Ruby maintainers from Bundler and rbenv teams are building rv to bring Python uv's speed and unified tooling approach to Ruby development.
Security News
Following last week’s supply chain attack, Nx published findings on the GitHub Actions exploit and moved npm publishing to Trusted Publishers.