Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
@muze-nl/simplystore
Advanced tools
SimplyStore is a radically simpler backend storage server. It does not have a database, certainly no SQL or GraphQL, it is not REST. In return it has a well defined API that is automatically derived from your dataset. It supports JSONTag to allow for sema
SimplyStore is a radically simpler backend storage server. It does not have a database, certainly no SQL or GraphQL, it is not REST. In return it has a well defined API that is automatically derived from your dataset. It supports JSONTag to allow for semantically meaningful data, without having to do the full switch to Linked Data and triple stores. The query format is javascript, you can post javascript queries that will run on the server. All data is read into memory and is available to these javascript queries without needing (or allowing) disk access or indexes.
JSONTag is an enhancement over JSON that allows you to tag JSON data with metadata using HTML-like tags. Javascript queries are run in a VM2 sandbox. You can query data using the array-where-select extension.
Note: There are known security issues in VM2, so the project will switch to V8-isolate. For now make sure SimplyStore is not publically accessible, by adding an api gateway in front of it for example
SimplyStore is a NodeJS/ExpressJS library. You can install it in your application like this:
npm install @muze-nl/simplystore
Import the server in your main file like this:
import simplystore from '@muze-nl/simplystore'
Then configure and start the server, like this:
simplystore.run({
datafile: process.cwd().'data.json'
})
simplystore is an express application, with all the usual options. Other options are:
If you start your server:
node myApp.js
You should be able to go http://localhost:3000/query/ and see something like this:
Given a dataset like this (jsontag):
{
"persons": [
<object id="john" class="Person">{
"name": "John",
"lastName": "Doe",
"dob": <date>"1972-09-20",
"foaf": [
<link>"jane"
]
},
<object id="jane" class="Person">{
"name": "Jane",
"lastName": "Doe",
"dob": <date>"1986-01-01",
"foaf": [
<link>"john"
]
}
]
}
You can post to the /query/ endpoint with javascript queries like these:
from(data.persons)
.where({
name: 'John'
})
.select({
name: _,
foaf: {
name: _
}
})
See the query documentation for more information about the query possibilities.
Remember: it is just javascript, so you can also use filter(), map() and reduce() on arrays. You can use all the default javascript API's, like Math, Array, Object, etc. You can not use any webbrowser API's, and you can't access any NodeJS API's. You do not have network access in your query.
Most important: queries cannot change the dataset, it is immutable.
The example directory contains a server that uses SimplyStore to serve a Star Wars API.
To start it:
cd example/
npm install
npm start
Now go to http://localhost:3000/query/ and you can run all the example queries from the query documentation
SimplyStore is a more defined and usable REST like service, out of the box. One where all you need to do is change the data and add some access rights and get a self-describing, browseable, working API.
The SimplyStore design is predicated on the following realisations:
So the scope for SimplyStore is:
In addition, SimplyStore is meant to be a real-world testcase for JSONTag.
MIT © Muze.nl
Contributions are welcome, but make sure that all code is MIT licensed. If you want to send a merge request, please make sure that there is a ticket that shows the bug/feature and reference it. If you find any problem, please do file a ticket, but you should not expect a timely resolution. This project is still very experimental, don't use it in production unless you are ready to fix problems yourself.
FAQs
SimplyStore is a radically simpler backend storage server. It does not have a database, certainly no SQL or GraphQL, it is not REST. In return it has a well defined API that is automatically derived from your dataset. It supports JSONTag to allow for sema
The npm package @muze-nl/simplystore receives a total of 16 weekly downloads. As such, @muze-nl/simplystore popularity was classified as not popular.
We found that @muze-nl/simplystore demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.