Research
Security News
Malicious npm Package Targets Solana Developers and Hijacks Funds
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
@jeaks03/overseer
Advanced tools
Overseer is a Typescript Aspect-Oriented framework for backend which takes inspiration from Spring-boot and Angular.
Before you begin, make sure your development environment includes Node.js® and an npm package manager.
Overseer requires Node.js version 8.x or 10.x.
Creating a Overseer project is as simple as:
npx @jeaks03/typescript-base -o
The npx @jeaks03/typescript-base
part creates a base for a typescript project and the -o
flag lets the installer know that it is an Overseer framework and makes the proper adjustments.
index.ts
import { Overseer } from '@jeaks03/overseer-core';
Overseer.serve(module, 8000);
my.controller.ts
import { Requisite, Pathway } from '@jeaks03/overseer-core';
@Requisite
export class MyController {
@Pathway({ path:'/hello' })
sayHello() {
return {
message: 'hello world!'
}
}
}
This example opens a http server
that listens on port 8000
and registers a GET
endpoint /hello
that returns the "hello world" message.
To start the application run:
npm run dev
Overseer.serve(8000)
line lets the framework know where the sources root is located, and what the port desired port is.@Requisite
makes transforms the class into an injectable and lets the framework find it. More on injectables and this decorator later.@Pathway
marks the method as a handler for the given path. The method is called when the endpoint is reached. More on this later.Section in which I explain how the framework functions.
For the framework to work correctly it must have it's directory structure as follows:
/src
/src/index.ts
then the resources directory must be /resources/
./resources/public
In the resources directory can be stored any kind of project files you need and access them freely. Inside it is the public directory where all the files are visible to the http server.
Let's say that you have a file named index.html inside and the server open on port 8000. If you make a request on localhost:8000/index.html
the file will be sent.
Note: If the file is named index.html
then the file will be available on both localhost:8000/index.html
and localhost:8000/
Documentation details regarding the decorators.
This decorator is used to mark the class as an injectable. Yes, Overseer also handles dependency injection in a manner similar to Angular's. In order to inject a requisite it must be a parameter for the constructor.
In order to let the framework find the requisites, all files that contain such classes must have their name ending in
.controller.ts
.service.ts
.component.ts
Example of dependency injection:
my.service.ts
import { Requisite } from '@jeaks03/overseer-core';
@Requisite
export class MyService {
public log(message: string): void {
console.log(message);
}
}
my-other.service.ts
import { Requisite } from '@jeaks03/overseer-core';
import MyService from './my.service';
@Requisite
export class MyOtherService {
constructor(private myService: MyService) {}
private onInit(): void {
this.myService.log('I got initialized!');
}
}
This decorator marks a method as the handler of the given path. It requires an argument of type WayDetails
which has the following attributes:
/
GET
200
['application/json']
['application/json', 'multipart/form-data', 'application/x-www-form-urlencoded']
Guard
implementations. This works just like Angular's guard security. Default: []
This decorator is used on requisites to mark a method as a lifecycle event. These events are triggered at a certain time during their life.
It accepts a string as a sort of event type to let it know when to trigger the method. These arguments are:
Shorthand version of @LifecycleEvent('onInit')
Shorthand version of @LifecycleEvent('afterInit')
This class handles and contains all the requisites.
An instance of this class can be imported under the name of Requisites
as a RestrictedRequisiteManager
interface.
RestrictedRequisiteManager:
interface RestrictedRequisiteManager {
addInstance: (instance, isController?: boolean) => void;
find: <T>(clazz: Class<T>) => T;
findByName: <T>(className: string) => T;
findAll: <T>(clazz: Class<T>) => T[];
}
In order to secure your application, you must provide an implementation of this class as a requisite. The default authentication
implementation provided is NoAuthentication
which basically behaves as if there is no security.
In order to create an instance for any Authentication
implementation you have to pass a UserProvider
to the constructor.
UserProvider
interface is a function that looks like this: (username: string) => UserDetails | Promise<UserDetails>
Overseer ships with the following implementations:
Here is an example of how to secure your application using basic auth:
export class SecurityComponent {
constructor(private database: DatabasePlaceHolder) { }
@OnInit()
secureApp() {
const auth = new BasicAuthentication((username: string) => this.database.findUser(username));
Requisites.addInstance(auth);
}
}
This class can be extended to create converters that understand other content types, and it looks like this:
export class Converter {
public getContentType(): string;
public canRead(target: string, contentType: string): boolean;
public canWrite(target: any, contentType: string): boolean;
public doWrite(target: any): string;
public doRead(target: string): any;
}
FAQs
Just another TypeScript Back-End framework
We found that @jeaks03/overseer demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
Security News
Research
Socket researchers have discovered malicious npm packages targeting crypto developers, stealing credentials and wallet data using spyware delivered through typosquats of popular cryptographic libraries.
Security News
Socket's package search now displays weekly downloads for npm packages, helping developers quickly assess popularity and make more informed decisions.