
Security News
/Research
Compromised Injective SDK npm Package Exfiltrates Wallet Keys and Mnemonics
Compromised Injective SDK npm version 1.20.21 exfiltrates wallet private keys and mnemonics through fake telemetry functionality.
@semantq/pylon
Advanced tools
Feature Guard Package For SaaS Aaplications
Model: Feature
Critical Columns:
- id (UUID)
- name (UNIQUE) → "form_create", "bulk_email", "display_stats"
- meterType → COUNT | ON_OFF
- timeframe → MONTHLY | YEARLY | FOREVER | null
- unit → "forms", "emails", "access"
- description → "Monthly form creation limit"
Purpose: Catalog of all possible billable features in the system.
Model: PricingPackage
Critical Columns:
- id (UUID)
- name → "Freemium", "Starter", "Pro"
- priceMonthly → 0, 29, 99
Purpose: Define the subscription tiers available to organizations.
Model: PricingPackageFeature (Junction Table)
Critical Columns:
- pricingPackageId (FK to PricingPackage)
- featureId (FK to Feature)
- status → true | false (is feature enabled in this package?)
- limitValue → 3, 50, 500, null (max usage for COUNT features)
Purpose: Define exactly what features each pricing package includes and their limits.
Model: Organization
Critical Columns:
- id (UUID)
- pricingPackageId (FK to PricingPackage)
Purpose: Connect each customer organization to their subscription tier.
Model: Metering
Critical Columns:
- organizationId (FK to Organization)
- featureId (FK to Feature)
- currentValue → 0, 1, 2, 3... (current usage count)
- periodStart → 2024-01-01 (start of current period)
- periodEnd → 2024-02-01 (end of current period)
Purpose: Track real-time usage per organization per feature. Created automatically when first used.
[Feature] (1) ←--- [PricingPackageFeature] (n) ---→ (1) [PricingPackage] (1) ---→ (n) [Organization]
↓ ↓
└-------------------→ (n) [Metering] (1) ←---------------------┘
(usage tracking)
Feature 1: name="form_create", meterType=COUNT, timeframe=MONTHLY, unit="forms"
Feature 2: name="bulk_email", meterType=COUNT, timeframe=MONTHLY, unit="emails"
Feature 3: name="display_stats", meterType=ON_OFF, timeframe=null, unit="access"
Create Pricing Packages:
Package 1: name="Freemium", priceMonthly=0
Package 2: name="Starter", priceMonthly=29
Package 3: name="Pro", priceMonthly=99
Assign Features to Packages:
Freemium + form_create → status=true, limitValue=3
Freemium + bulk_email → status=false, limitValue=0
Freemium + display_stats → status=false, limitValue=0
Starter + form_create → status=true, limitValue=50
Starter + bulk_email → status=true, limitValue=300
Starter + display_stats → status=true, limitValue=1
Pro + form_create → status=true, limitValue=500
Pro + bulk_email → status=true, limitValue=5000
Pro + display_stats → status=true, limitValue=1
Organization "Acme Inc" → Starter package
Organization "Startup LLC" → Freemium package
Metering record created: org=Acme, feature=form_create, currentValue=1| Step | Model | Critical Fields | Purpose |
|---|---|---|---|
| 1 | Feature | name, meterType, timeframe | Define what can be metered |
| 2 | PricingPackage | name, priceMonthly | Define product tiers |
| 3 | PricingPackageFeature | status, limitValue | Set package-specific limits |
| 4 | Organization | pricingPackageId | Assign customer to tier |
| 5 | Metering | currentValue, periodStart/End | Track real usage |
This gives SuperAdmin complete control over the feature economy while keeping the runtime simple for developers.
FAQs
Feature Guard Package For SaaS Applications
The npm package @semantq/pylon receives a total of 7 weekly downloads. As such, @semantq/pylon popularity was classified as not popular.
We found that @semantq/pylon demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
/Research
Compromised Injective SDK npm version 1.20.21 exfiltrates wallet private keys and mnemonics through fake telemetry functionality.

Security News
npm v12 is generally available, turning install scripts off by default and beginning the deprecation of 2FA-bypass publishing tokens.

Research
/Security News
Socket tracks the activity as Operation “Muck and Load”: a threat actor uses commit-farming workflows, public dead drops, and protected archives to stage Windows RAT and infostealer malware.