
Research
npm Malware Targets Telegram Bot Developers with Persistent SSH Backdoors
Malicious npm packages posing as Telegram bot libraries install SSH backdoors and exfiltrate data from Linux developer machines.
@hapipal/toys
Advanced tools
The hapi utility toy chest
Lead Maintainer - Devin Ivy
See also the API Reference
For support below node v12 or hapi v19 see toys v2.
Toys is a collection of utilities made to reduce common boilerplate in hapi v19+ projects, aid usage of events and streams in async
functions (e.g. handlers and server methods), and provide versions of widely-used utilities from Hoek optimized to perform well in hot code paths such as route handlers.
Below is an example featuring Toys.auth.strategy()
, Toys.reacher()
, and Toys.withRouteDefaults()
. The API Reference is also filled with examples.
const Hapi = require('@hapi/hapi');
const Boom = require('@hapi/boom');
const Toys = require('@hapipal/toys');
(async () => {
const server = Hapi.server();
// Make a one-off auth strategy for testing
Toys.auth.strategy(server, 'name-from-param', (request, h) => {
// Yes, perhaps not the most secure
const { username } = request.params;
if (!username) {
throw Boom.unauthorized(null, 'Custom');
}
return h.authenticated({ credentials: { user: { name: username } } });
});
// Make function to efficiently index into a request to grab an authed user's name
const grabAuthedUsername = Toys.reacher('auth.credentials.user.name');
// Default all route methods to "get", unless otherwise specified
const defaultToGet = Toys.withRouteDefaults({ method: 'get' });
server.route(
defaultToGet([
{
method: 'post',
path: '/',
handler: (request) => {
return { posted: true };
}
},
{ // Look ma, my method is defaulting to "get"!
path: '/as/{username}',
options: {
auth: 'name-from-param', // Here's our simple auth strategy
handler: (request) => {
// grabAuthedUsername() is designed to be quick
const username = grabAuthedUsername(request);
return { username };
}
}
}
])
);
await server.start();
console.log(`Now, go forth and ${server.info.uri}/as/your-name`);
})();
FAQs
The hapi utility toy chest
The npm package @hapipal/toys receives a total of 5,851 weekly downloads. As such, @hapipal/toys popularity was classified as popular.
We found that @hapipal/toys demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 3 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Malicious npm packages posing as Telegram bot libraries install SSH backdoors and exfiltrate data from Linux developer machines.
Security News
pip, PDM, pip-audit, and the packaging library are already adding support for Python’s new lock file format.
Product
Socket's Go support is now generally available, bringing automatic scanning and deep code analysis to all users with Go projects.