
Research
/Security News
Weaponizing Discord for Command and Control Across npm, PyPI, and RubyGems.org
Socket researchers uncover how threat actors weaponize Discord across the npm, PyPI, and RubyGems ecosystems to exfiltrate sensitive data.
@gasbuddy/configured-swagger-client
Advanced tools
A module that creates a set of swagger clients with support for inter-service tracing, custom certificates, and separated endpoint configuration
GasBuddy has chosen Swagger as our API format for all services. Luckily, a growing number of partners are also using Swagger. Our services are written mostly in Node.js, and this module is an attempt to make the process of wiring a Node.js project to Swagger services easier and more robust.
We have a variety of "independent components":
All of these components likely make use of other Swagger services. Each of these services is defined by a JSON swagger specification and will use small-swagger-codegen to generate a client package. This is a departure from versions < 5.x of this library which generated a JSON spec and the client was dynamically generated. THe value of pregeneration is full type information available at development time, which includes autocompleting complex method names and request structures, which in a language like Javascript, can reduce bugs significantly without losing the flexibility (since it's just a generator doing the typing work).
One of the other important things we do is create a "CorrelationId" - a single identifier which can be traced all through the logs of all of the services that request touches. This module creates an easy way to pass that CorrelationId along in dependent service calls.
See the tests for example usage, but here's a simple one:
import PetApi from 'a-node-module-from-small-swagger-codegen';
const petApi = new PetApi(req.gb.serviceFactory);
const pets = await services.Pets.findPetsByStatus({ status: 'pending' });
// pets.obj has your pets!
The CorrelationId support is accomplished via a requestInterceptor option to the rest-api-support methods. rest-api-support also supports adding headers (such as authorization headers) in this phase. Metric collection is also enabled by the requestInterceptor/responseInterceptor pair.
FAQs
A module that creates a set of swagger clients with support for inter-service tracing, custom certificates, and separated endpoint configuration
We found that @gasbuddy/configured-swagger-client demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 3 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
Socket researchers uncover how threat actors weaponize Discord across the npm, PyPI, and RubyGems ecosystems to exfiltrate sensitive data.
Security News
Socket now integrates with Bun 1.3’s Security Scanner API to block risky packages at install time and enforce your organization’s policies in local dev and CI.
Research
The Socket Threat Research Team is tracking weekly intrusions into the npm registry that follow a repeatable adversarial playbook used by North Korean state-sponsored actors.