Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
@harnessio/ff-nodejs-server-sdk
Advanced tools
Use this README to get started with our Feature Flags (FF) SDK for Node.js. This guide outlines the basics of getting started with the SDK and provides a full code sample for you to try out.
This sample doesn't include configuration options, for in depth steps and configuring the SDK, for example, disabling streaming or using our Relay Proxy, see the Node.js SDK Reference.
To use this SDK, make sure you’ve:
To follow along with our test code sample, make sure you’ve:
harnessappdemodarkmode
The first step is to install the FF SDK as a dependency in your application. To install using npm, use:
npm install @harnessio/ff-nodejs-server-sdk
Or to install with yarn, use:
yarn add @harnessio/ff-nodejs-server-sdk
The following is a complete code example that you can use to test the harnessappdemodarkmode
Flag you created on the
Harness Platform. When you run the code it will:
harnessappdemodarkmode
Flag is toggled on or off on the Harness Platform and report the new value.const { Client, Event } = require('@harnessio/ff-nodejs-server-sdk');
(async () => {
// set apiKey to your SDK API Key
const apiKey = 'YOUR_FF_SDK_KEY';
// set flagName to your flag identifier from the UI
const flagName = 'harnessappdemodarkmode';
console.log('Harness SDK Getting Started');
// Create Client
const client = new Client(apiKey);
// Create a target (different targets can receive different results based on rules.
// Here we are including "location" as a custom attribute)
const target = {
identifier: 'nodeserversdk',
name: 'NodeServerSDK',
attributes: {
location: 'emea',
},
};
try {
await client.waitForInitialization();
} catch (e) {
console.log("Error when authenticating Feature Flags client: " + e)
}
try {
// Log the state of the flag every 10 seconds
setInterval(async () => {
const value = await client.boolVariation(flagName, target, false);
console.log('Flag variation:', value);
}, 10000);
// We can also watch for the event when a flag changes
client.on(Event.CHANGED, async (flagIdentifier) => {
const value = await client.boolVariation(flagIdentifier, target, false);
console.log(`${flagIdentifier} changed: ${value}`);
});
} catch (e) {
console.error('Error:', e);
}
})();
To run the example, execute your script:
node example.js
When you're finished you can exit the example by stopping the process using control-c.
If using a proxy or SMP instance that does not use a widely publicised pre-bundled CA you can provide your own CA using the tlsTrustedCa
option.
This option takes a path to a file that contains a bundle of certificates in PEM format. If this option is present, the HTTP client will ignore
any pre-bundled certs so you need to include the entire certificate chain of your custom cert.
const client = new Client(apiKey, {
baseUrl: 'https://ffserver:8000/api/1.0',
eventsUrl: 'https://ffserver:8001/api/1.0',
tlsTrustedCa: 'path_to_cert_chain.crt',
});
For further examples and config options, see the Node.js SDK Reference and the test Node.js project. For more information about Feature Flags, see our Feature Flags documentation.
FAQs
Feature flags SDK for NodeJS environments
We found that @harnessio/ff-nodejs-server-sdk demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.