
Research
/Security News
5 Malicious Rust Crates Posed as Time Utilities to Exfiltrate .env Files
Published late February to early March 2026, these crates impersonate timeapi.io and POST .env secrets to a threat actor-controlled lookalike domain.
@eggjs/redis
Advanced tools
Valkey / Redis client (support redis protocol) based on iovalkey for egg framework
npm i @eggjs/redis
Valkey / Redis Plugin for egg, support egg application access to Valkey / Redis Service.
This plugin based on ioredis. If you want to know specific usage, you should refer to the document of ioredis.
Change ${app_root}/config/plugin.js to enable redis plugin:
exports.redis = {
enable: true,
package: '@eggjs/redis',
};
Configure redis information in ${app_root}/config/config.default.js:
Single Client
config.redis = {
client: {
port: 6379, // Redis port
host: '127.0.0.1', // Redis host
password: 'auth',
db: 0,
},
}
Multi Clients
config.redis = {
clients: {
foo: { // instanceName. See below
port: 6379, // Redis port
host: '127.0.0.1', // Redis host
password: 'auth',
db: 0,
},
bar: {
port: 6379,
host: '127.0.0.1',
password: 'auth',
db: 1,
},
}
}
Sentinel
config.redis = {
client: {
// Sentinel instances
sentinels: [
{
port: 26379, // Sentinel port
host: '127.0.0.1', // Sentinel host
},
// other sentinel instance config
],
name: 'mymaster', // Master name
password: 'auth',
db: 0
},
}
No password
Redis support no authentication access, but we are highly recommend you to use redis requirepass in redis.conf.
$vim /etc/redis/redis.conf
requirepass xxxxxxxxxx // xxxxxxxxxx is your password
Because it may be cause security risk, refer:
If you want to access redis with no password, use password: null.
See ioredis API Documentation for all available options.
ioredis version@eggjs/redis using ioredis@5 now, if you want to use other version of iovalkey or ioredis,
you can pass the instance by config.redis.Redis:
// config/config.default.js
config.redis = {
Redis: require('ioredis'), // customize ioredis version, only set when you needed
client: {
port: 6379, // Redis port
host: '127.0.0.1', // Redis host
password: 'auth',
db: 0,
},
}
weakDependent
config.redis = {
client: {
port: 6379, // Redis port
host: '127.0.0.1', // Redis host
password: 'auth',
db: 0,
weakDependent: true, // the redis instance won't block app start
},
}
In controller, you can use app.redis to get the redis instance, check ioredis to see how to use.
// app/controller/home.js
module.exports = app => {
return class HomeController extends app.Controller {
async index() {
const { ctx, app } = this;
// set
await app.redis.set('foo', 'bar');
// get
ctx.body = await app.redis.get('foo');
}
};
};
If your Configure with multi clients, you can use app.redis.get(instanceName) to get the specific redis instance and use it like above.
// app/controller/home.js
module.exports = app => {
return class HomeController extends app.Controller {
async index() {
const { ctx, app } = this;
// set
await app.redis.get('instance1').set('foo', 'bar');
// get
ctx.body = await app.redis.get('instance1').get('foo');
}
};
};
Before you start to use Redis Cluster, please checkout the document first, especially confirm cluster-enabled yes in Redis Cluster configuration file.
In controller, you also can use app.redis to get the redis instance based on Redis Cluster.
// app/config/config.default.js
exports.redis = {
client: {
cluster: true,
nodes: [
{
host: '127.0.0.1',
port: '6379',
family: 'user',
password: 'password',
db: 'db',
},
{
host: '127.0.0.1',
port: '6380',
family: 'user',
password: 'password',
db: 'db',
},
],
},
};
// app/controller/home.js
module.exports = app => {
return class HomeController extends app.Controller {
async index() {
const { ctx, app } = this;
// set
await app.redis.set('foo', 'bar');
// get
ctx.body = await app.redis.get('foo');
}
};
};
Please open an issue here.
Made with contributors-img.
FAQs
Valkey / Redis plugin for egg
We found that @eggjs/redis demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 13 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Published late February to early March 2026, these crates impersonate timeapi.io and POST .env secrets to a threat actor-controlled lookalike domain.

Security News
A recent burst of security disclosures in the OpenClaw project is drawing attention to how vulnerability information flows across advisory and CVE systems.

Research
/Security News
Mixed-script homoglyphs and a lookalike domain mimic imToken’s import flow to capture mnemonics and private keys.