Security News
Research
Supply Chain Attack on Rspack npm Packages Injects Cryptojacking Malware
A supply chain attack on Rspack's npm packages injected cryptomining malware, potentially impacting thousands of developers.
@globocom/backstage-functions-sandbox
Advanced tools
functions-sandbox is the engine behind Backstage Functions and executes code in isolation (a sandbox). It could be used for both running code in production as well as testing the deployed functions (before they are deployed, hopefully).
$ npm install @globocom/functions-sandbox
const Sandbox = require('backstage-functions-sandbox');
const mySandbox = new Sandbox({
env: {
MY_VAR: 'TRUE', // environment variable will be available on Backstage.env.MY_VAR
},
globalModules: [ 'path' ], // put all available modules that will allow to import
asyncTimeout: 10000,
syncTimeout: 300,
});
const myCode = mySandbox.compileCode('test.js', `
async function main(req, res) {
const result = req.body.x * req.body.y;
const name = Backstage.env.MY_VAR;
// you could call await here
return { name, result };
}
`);
// express.Request compatible
const req = {
headers: {},
query: {},
body: { x: 10, y: 10}
};
mySandbox.runScript(myCode, req).then(({status, body}) => {
console.info('Result:', status, body);
}, (err) => {
console.error('Error:', err);
});
const { executeFunctionInSandbox } = require('backstage-functions-sandbox/lib/ForkSandbox');
const myCode = `
async function main(req, res) {
const result = req.body.x * req.body.y;
const name = Backstage.env.MY_VAR;
// you could call await here
return { name, result };
}
`;
const req = {
headers: {},
query: {},
body: { x: 10, y: 10}
};
const taskId = `${namespace}/${id}-${Date.now()}`; //or can be any uniq id
executeFunctionInSandbox(taskId, {
env: {
MY_VAR: 'TRUE', // environment variable will be available on Backstage.env.MY_VAR
},
globalModules: [ 'path' ], // put all available modules that will allow to import
asyncTimeout: 10000,
syncTimeout: 300,
preCode: code, // not required to compile using sandbox.Compilecode
req,
namespace: "foo",
functionName: "bar",
options,
})
/* can return result using callback or using async await */
.then(result => {
console.log(result)
})
.catch(err => {
console.log(err)
})
Name | Description | Example |
---|---|---|
env | Environment variables used by deployed functions | { MY_VAR: 'Some value' } |
syncTimeout | Timeout when executing synchronous functions | syncTimeout: 300 |
asyncTimeout | Timeout when executing asynchronous functions | asyncTimeout: 1000 |
globalModules | Modules that will be available to all functions | globalModules: [ 'path/to/module' ] |
Property | Type | Description |
---|---|---|
headers | property | HTTP Headers received from this request |
query | property | HTTP parsed querystring |
body | property | HTTP body decoded from json |
Property | Type | Description |
---|---|---|
set(header, value) | method | set a HTTP Header value |
status(statusCode) | method | change status code of this response, default: 200 |
send(body) | method | finalize the response sending body to the client |
notModified() | method | finalize the response sending 304 without body |
badRequest(msg) | method | finalize the response sending 400 with error msg |
notFound(msg) | method | finalize the response sending 404 with error msg |
unprocessableEntity(msg) | method | finalize the response sending 422 with error msg |
internalServerError(msg) | method | finalize the response sending 500 with error msg |
Class | Description |
---|---|
NotModified() | finalize the response sending 304 without body |
BadRequest(msg) | finalize the response sending 400 with error msg |
NotFound(msg) | finalize the response sending 404 with error msg |
UnprocessableEntity(msg) | finalize the response sending 422 with error msg |
InternalServerError(msg) | finalize the response sending 500 with error msg |
FAQs
Sandbox for Backstage functions
The npm package @globocom/backstage-functions-sandbox receives a total of 8 weekly downloads. As such, @globocom/backstage-functions-sandbox popularity was classified as not popular.
We found that @globocom/backstage-functions-sandbox demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 11 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
A supply chain attack on Rspack's npm packages injected cryptomining malware, potentially impacting thousands of developers.
Research
Security News
Socket researchers discovered a malware campaign on npm delivering the Skuld infostealer via typosquatted packages, exposing sensitive data.
Security News
Sonar’s acquisition of Tidelift highlights a growing industry shift toward sustainable open source funding, addressing maintainer burnout and critical software dependencies.