
Research
/Security News
OpenAPI React Query Codegen Compromised in Mini Shai-Hulud npm Supply Chain Attack
Ten malicious OpenAPI React Query Codegen versions were published to npm in the Mini Shai-Hulud attack, all with valid provenance.
@mearl/daemon-core
Advanced tools
Shared Node daemon lifecycle primitives for Mearl — process liveness, JSON record registry, log rotation, and a detached daemon manager
Mearl 各 Node 包共享的守护进程生命周期原语:进程存活探测、JSON 记录注册表、日志滚动,以及一个 detached 守护进程管理器。
把 cloud-server、cloud-connector、native-host 里原本各写一份、容易彼此漂移的 daemon 逻辑(isAlive、原子读写注册表、日志滚动、按 key 派生路径)收敛到这一处,确保「写方」和「读方」对记录位置与格式始终一致。
仅供 monorepo 内部使用(Node-only)。
cloud-server/cloud-connector以普通依赖引入(运行时从 npm 解析),native-host在打包时直接内联。
isAlive(pid: number | undefined | null): boolean
用 signal-0 探测进程是否存活(EPERM 视为存活——进程存在但属于他人)。
DAEMON_HOME // ~/.mearl
hashKey(key: string): string // sha256(key) 前 16 位十六进制
keyedDir(subdir: string): string // ~/.mearl/<subdir>
keyedConfigFile(subdir, key): string // ~/.mearl/<subdir>/<hash>.json
keyedLogFile(subdir, key): string // ~/.mearl/<subdir>/<hash>.log
多实例子系统(如按 serverUrl 区分的连接器)用这些 helper 派生每实例的文件路径。所有读写方都必须经由它们派生路径,这样彼此才不会对记录位置产生分歧。
interface DaemonRecord { pid: number; startedAt?: string; [k: string]: unknown }
ensureDir(dir: string): void
writeRecord(file: string, record: DaemonRecord): void // 临时文件 + rename 原子写
readRecord<T>(file: string): T | null
removeRecord(file: string): void
listRecordFiles(dir: string): string[] // 目录下所有 *.json 绝对路径
readLiveRecords<T>(dir: string): T[] // 读取存活记录,并顺带清理死记录
createDaemon(opts: CreateDaemonOptions): Daemon
围绕一对 (configFile, logFile) 构建单实例守护进程管理器。模型:start() 以 --foreground detached 方式重新拉起消费方自己的 CLI;子进程运行实际服务,就绪后把自己的 pid 写入 configFile,父进程轮询 record.pid === child.pid 确认其已起来(而非死亡或卡住)。多实例子系统按实例 key 派生 configFile/logFile,为每个实例各创建一个管理器。
interface CreateDaemonOptions {
name: string; // 日志标签,如 'CloudServer' / 'CloudConnector'
scriptPath: string; // 可重新拉起的 CLI 脚本绝对路径(消费方打包后的 cli.js)
configFile: string; // 本实例的 JSON 记录文件(由前台子进程写入)
logFile: string; // 本实例的日志文件
foregroundArgs?: string[]; // 追加在 `--foreground` 之后的 argv
readyTimeoutMs?: number; // 等待子进程写记录的超时(默认 15000ms)
formatInfo?: (record: DaemonRecord) => string | null; // 起来后额外打印的信息
}
interface Daemon {
start(): Promise<void>;
stop(): Promise<void>;
restart(): Promise<void>;
status(): void;
logs(lines?: number): void;
running(): DaemonRecord | null;
}
scriptPath必须是消费方自己的cli.js:用打包进 cli 入口的某个模块里的fileURLToPath(import.meta.url)计算。daemon-core 自身被独立解析时,它的import.meta.url指向 daemon-core,而不是 cli。
rotateLogIfNeeded(logFile: string, maxBytes?: number): void // 超限则滚动为 <log>.1,默认 5MB
tailFile(logFile: string, lines: number): string
createDaemon(单实例,~/.mearl/cloud-server.json)createDaemon(多实例,按 serverUrl 区分,~/.mearl/connectors/<hash>.json)+ readLiveRecords 列举isAlive / keyedConfigFile / readRecord / readLiveRecords 等)读取连接器共享注册表,以发现/接管/列举连接器FAQs
Shared Node daemon lifecycle primitives for Mearl — process liveness, JSON record registry, log rotation, and a detached daemon manager
The npm package @mearl/daemon-core receives a total of 1,293 weekly downloads. As such, @mearl/daemon-core popularity was classified as popular.
We found that @mearl/daemon-core demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.

Research
/Security News
Ten malicious OpenAPI React Query Codegen versions were published to npm in the Mini Shai-Hulud attack, all with valid provenance.

Security News
Socket joins more than 100 technology, cybersecurity, and financial organizations calling for a global surge in cyber defense.

Product
Enterprise security teams can now detect malware, credential theft, suspicious network activity, and risky updates across Microsoft Edge extensions.