
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
@mvx/identity-server
Advanced tools
identity server for mvc, type-mvc is base on koa. Decorator, Ioc, AOP mvc framework on server.
This repo is for distribution on npm. The source for this module is in the
main repo.
@mvx/identity-server is model parser for MVC frameworker. base on ioc @tsdi. help you develop your project easily.
You can install this package either with npm
npm install @mvx/identity-server
create application
import { MvcApplication, DefaultMvcMiddlewares, MvcModule, MvcServer } from '@mvx/mvc';
import { IdentityModule } from '@mvx/identity-server';
// 1. use MvcHostBuilder to boot application.
MvcApplication.run();
// 2. use bootstrap module to boot application
@MvcModule({
// baseURL: __dirname,
imports: [
IdentityModule
//... you service, or controller, some extends module.
],
debug: true
})
class MvcApi {
constructor() {
console.log('boot application');
}
}
// 3. use MvcHostBuilder to boot application module.
@MvcModule({
imports: [
TypeOrmModule
// ... /... you service, or controller, some extends module.
// DebugLogAspect
],
middlewares: DefaultMvcMiddlewares,
// bootstrap: MvcServer
})
class MvcApi {
}
MvcApplication.run(MvcApi);
//4. use bootstrap module to boot application by main.
@MvcModule({
imports: [
TypeOrmModule
// ...
],
// bootstrap: MvcServer,
debug: true
})
class MvcApi {
constructor() {
console.log('boot application');
}
static main() {
console.log('run mvc api...');
MvcApplication.run(MvcApi);
}
}
default setting load controllers in your project folder
/controllers
ResultValue, also you can return base type or object, it deal with JsonResult.async or sync. Have provide FileResult, JsonResult,
RedirectResult, ViewResult.BaseController, it has implements some mothod to create the ResultValue types.@Cors decorator in class or method.define as:
import { Controller, Get, Post, IContext, ContextToken, RequestMethod, Model, Field, Cors } from '@mvx/mvc';
import { Inject } from '@tsdi/core';
import { Mywork } from '../bi/Mywork';
import { User } from '../models';
@Cors
@Controller('/users')
export class UserController {
// @Inject(symbols.IContext)
// context: IContext;
constructor(private work: Mywork) {
}
@Get('')
index() {
console.log('home index invorked', this.work);
return this.work.workA();
}
// @Cors([RequestMethod.Post])
// also can define as below
// @Cors(['Post','Get'])
// @Cors('POST,GET')
@Post('/add')
async addUser(user: User, @Inject(ContextToken) ctx: IContext) {
console.log('user:', user);
console.log('request body', ctx.request['body']);
return this.work.save(user);
}
@Get('/sub')
sub() {
return this.work.workB();
}
@Get('/:name')
getPerson(name: string) {
return this.work.find(name);
}
@Get('/find/:name')
query(name: string, @Inject(ContextToken) ctx) {
console.log(ctx);
return this.work.find(name);
}
@Get('/test/:id')
parmtest(id: number) {
if (id === 1) {
return this.work.workA();
} else if (id === 2) {
return this.work.workB();
} else {
return 'notFound';
}
}
@Post('/posttest/:id')
postTest(id: number) {
return {
id: id
}
}
}
@Controller('/')
export class HomeController extends BaseController {
// @Inject(ContextToken)
// context: IContext;
constructor() {
super();
}
@Get('')
index(): ResultValue {
return this.view('index.html');
}
@Get('/index2')
home2(): ResultValue {
return this.view('index2.html');
}
@Post('/goto/:pageName')
gotoPage(pageName: string): ResultValue {
return this.redirect( '/' + pageName);
}
}
Auto load Aspect service from folder /aop in your project.
see simple demo
import { Aspect, Around, Joinpoint, Before } from '@tsdi/aop';
@Aspect
export class DebugLog {
@Around('execution(*Controller.*)')
log(joinPoint: Joinpoint) {
console.log('aspect append log, method name:', joinPoint.fullName, ' state:', joinPoint.state, ' Args:', joinPoint.args , ' returning:', joinPoint.returning, ' throwing:', joinPoint.throwing);
}
@Before(/Controller.\*$/)
Beforlog(joinPoint: Joinpoint) {
console.log('aspect Befor log:', joinPoint.fullName);
}
}
default setting load middlewares in your project folder
/middlewares
import { Middleware, IMiddleware, Application, Configuration } from '@mvx/mvc';
import { IContainer, Injectable } from '@tsdi/core';
@Middleware('logger')
export class Logger implements IMiddleware {
constructor() {
}
async execute (ctx, next) {
let start = Date.now();
await next();
const ms = Date.now() - start;
console.log(`mylog: ${ctx.method} ${ctx.url} - ${ms}ms`);
let end = new Date();
}
}
1.0.1
0.6.3
0.5.5
v0.5.3
v0.5.1
add Log aop aspect service. for Log easy. default user console to log, can config logLib,logConfig in your config.js to use third logger lib. eg. { logLib: 'log4js', logConfig:{...} }.
has implements log4js adapter see code
DebugAspect, config debug: true, in your config.js, will auto log debug info.
AnnotationLogerAspect @annotation(Logger), logger some state via @Logger decorator config.
add Annotation Auth aspect service AuthAspect to support yourself auth check easy. eg.
@Aspect
export class YourSecrityAspect {
// before AuthAspect.auth check some.
@Before('execution(AuthAspect.auth)', 'authAnnotation')
sessionCheck(authAnnotation: AuthorizationMetadata[], joinPoint: Joinpoint) {
//TODO: you check by authAnnotation
}
}
MIT © Houjun
FAQs
identity server for mvc, type-mvc is base on koa. Decorator, Ioc, AOP mvc framework on server.
We found that @mvx/identity-server demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.