
Security News
The Hidden Blast Radius of the Axios Compromise
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.
@neohelden/node
Advanced tools
Meta library for common Node.js dependencies necessary / recommended for developing Neo Sentinels.
Neo SDK for Node.js with some additional libraries to support the development of Neo Sentinels (NSX).
yarn add @neohelden/node
The Neo SDK can be configured through environment variables (ENVs in short). The following ENVs are supported:
NPQ_DISABLE_AUTOCONNECT: Set to true in order to prevent the SDK from autoconnecting.NPQ_NAME: A identifiable name for your Sentinel.NPQ_CA: A base64 encoded CA used for The NATS TLS OptionNPQ_CERT: A base64 encoded string used as a client certificate (signed by the NPQ_CA)NPQ_CERT_KEY: A base64 encoded private key belonging to the NPQ_CERT.The SDK comes with its own healthcheck server and admi application. This server allows to dynamically change the logging level and to check the health of the service.
To init it use:
AdminApplication.init('nsx.test');
Tasks are an integral part of the Neo plattform.
This method is not intended to be used anymore since it violates the principles of MQTT messaging. The Pub/Sub model is intended to achieve async messages. However until there are more etablished patterns for the Neo plattform, this method can be used to request information from a Sentinel.
import { TaskConnector } from '@neohelden/node';
import { IsString } from 'class-validator';
import { Expose } from 'class-transformer';
const client = new TaskConnector();
class Transmit {
@IsString()
test!: string;
}
class Response {
@Expose()
@IsString()
test!: string;
}
await client.connect();
const response = await client.requestOne('nsx.test', new Transmit(), Response);
console.log(response.test); // 'Hello World'
A subscription modal can be achieved in two modes:
import { TaskConnector } from '@neohelden/node';
import { IsString } from 'class-validator';
import { Expose } from 'class-transformer';
const client = new TaskConnector();
class Transmit {
@IsString()
test!: string;
}
class Response {
@Expose()
@IsString()
test!: string;
}
await client.connect();
client.subscribe(
'nsx.test',
Transmit,
async (err: Error | null, transmit: Transmit) => {
// Response will not be used
console.log(transmit.test); // 'Hello World'
},
);
client.respondingSubscribe('nsx.test', Transmit, async (transmit: Transmit) => {
return new Response();
});
By publishing data, a Sentinel can inform other Sentinels about something.
const { TaskConnector } = require('@neohelden/node');
const client = new TaskConnector();
class Transmit {
@IsString()
test!: string;
}
await client.connect();
const transmit = new Transmit();
transmit.test = 'Hello World';
await client.publish('nsx.test', transmit);
A service can inform the infrastructure if it is operational or not. This can be achieved using the admin Application. The singelton is responsible for managing logging and health.
import AdminApplication from '../AdminApplication';
import HealthCheckResponse from '../health/HealthCheckResponse';
await AdminApplication.init('nsx.current.name');
await AdminApplication.addHealthProbe({
call: () => HealthCheckResponse.up('test'),
}); // for health
await AdminApplication.addReadinessProbe({
call: () => HealthCheckResponse.up('test'),
}); // for readiness
await AdminApplication.stop();
Module for logging information (based on pino).
import { LoggerFactory } from '@neohelden/node';
const logger = LoggerFactory.create('my-sentinel');
logger.info('Neo informs.');
logger.warn('Neo warns.');
logger.error('aaaah, houston?');
To change the logging verbosity, set the environment variable LOG_LEVEL. Additionally the logging can be changed while running through an HTTP server located in the ADMIN_PORT || 8081.
import { Sentry } from '@neohelden/node';
sentry.initSentry({
release: 'v0.1.0',
});
FAQs
Meta library for common Node.js dependencies necessary / recommended for developing Neo Sentinels.
The npm package @neohelden/node receives a total of 94 weekly downloads. As such, @neohelden/node popularity was classified as not popular.
We found that @neohelden/node demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.