
Research
Security News
Lazarus Strikes npm Again with New Wave of Malicious Packages
The Socket Research Team has discovered six new malicious npm packages linked to North Korea’s Lazarus Group, designed to steal credentials and deploy backdoors.
@mvp-rockets/namma-lib
Advanced tools
└── lib
├── logger.js
├── token.js
├── utilities
│ ├── api-error.js
│ ├── args.js
│ ├── compose-result.js
│ ├── doNothing.js
│ ├── http-constant.js
│ ├── ifElse.js
│ ├── logger.js
│ ├── respond.js
│ ├── transform-to-result.js
│ ├── uuid.js
│ ├── whenResult.js
│ └── with-args.js
└── validations
├── check-given-values.js
├── has-length-of.js
├── is-boolean.js
├── is-email.js
├── is-mobile-number.js
├── is-string-numeric.js
├── is-timestamp.js
├── is-undefined.js
├── max-value.js
├── min-value.js
├── not-empty.js
├── numeric.js
├── should-be-uuid.js
├── validate-given-pattern.js
└── validate.js
npm install @mvp-rockets/namma-lib
const {
utilities:{
logInfo,
logError,
....
....
all the utilities function here
},
validations:{
isBoolean,
hasLengthOf,
....
....
all the validations function here
},
HTTP_CONSTANT,
token
} = require('@mvp-rockets/namma-lib')
const {
logInfo,
logError,
....
....
all the utilities function here
} = require('@mvp-rockets/namma-lib/utilities')
const {
logInfo,
logError,
....
....
all the utilities function here
} = require('@mvp-rockets/namma-lib/validations')
const {
token
} = require('@mvp-rockets/namma-lib')
Only the HTTP_CONSTANT
const {
HTTP_CONSTANT
} = require('@mvp-rockets/namma-lib')
<!-- initialize token in your index.js -->
const {
token
} = require('@mvp-rockets/namma-lib');
token.initialize("Your Jwt secret key");
<!-- Generate Token -->
const tokenResult = await token.generate("Your object")
console.log(tokenResult); // Result.Ok("Your generated token")
<!-- decode token -->
const decodedTokenResult = await token.decode("Your token")
console.log(decodedTokenResult); // Result.Ok("Your decoded object")
if case of invalid or expired token
console.log(decodedTokenResult); // Result.Error("Invalid token")
Now logger comes with two libraries internally ie, winston and pino. By default it uses winston.
<!-- initialize logger in your index.js -->
const { Logger } = require('@mvp-rockets/namma-lib');
Logger.initialize({
isEnable: true, // for dev,qa use false
type: 'aws',
environment: "<env name>",
clsNameSpace: <"cls name for trace Id">,
configurations: {
region: <"aws region">,
accessKeyId: <"aws access Key Id">,
secretKey: <"aws secret Key">,
logGroupName: <"log group name">,
logStreamName: <"log stream name">
}
});
<!-- add below code for unique traceId for each request -->
const { logInfo } = require('@mvp-rockets/namma-lib/utilitiesut');
app.use((req, res, next) => {
const namespace = cls.getNamespace("<cls name for trace Id>");
const platform = req.headers['x-platform'] || 'unknown-platform';
namespace.run(() => {
namespace.set('traceId', uuid.v4());
logInfo(`${req.method} ${req.originalUrl}`, { ...req.body, platform });
next();
});
});
To use pino, you need to pass following properties
loggerType: "pino"
loggerOptions: "cloudwatch"
Using pino logger you can send logs to more than one destination. for now Options are file, cloudwatch, terminal and loki.
To use more than one destination you can specify in loggerOptions by comma separated values.
for example:
loggerOptions: "cloudwatch, file, loki"
Usage example for pino logger:
Logger.initialize({
environment: "<env name>",
clsNameSpace: <"cls name for trace Id">,
configurations: {
region: <"aws region">,
accessKeyId: <"aws access Key Id">,
secretKey: <"aws secret Key">,
logGroupName: <"log group name">,
logStreamName: <"log stream name">,
interval: <"interval integer value">
},
loggerType: "pino"
loggerOptions: "cloudwatch"
});
NOTE: Before switching to pino logger, make sure if you have alerts based on level: error. you need to make some change because for now using this library. level will be integer(info as 30, error as 50) and there will be another property label where value will be error, info, debug.
FAQs
A functional utility library for developing express api
The npm package @mvp-rockets/namma-lib receives a total of 1,223 weekly downloads. As such, @mvp-rockets/namma-lib popularity was classified as popular.
We found that @mvp-rockets/namma-lib demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 3 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
The Socket Research Team has discovered six new malicious npm packages linked to North Korea’s Lazarus Group, designed to steal credentials and deploy backdoors.
Security News
Socket CEO Feross Aboukhadijeh discusses the open web, open source security, and how Socket tackles software supply chain attacks on The Pair Program podcast.
Security News
Opengrep continues building momentum with the alpha release of its Playground tool, demonstrating the project's rapid evolution just two months after its initial launch.