Research
Security News
Malicious npm Package Targets Solana Developers and Hijacks Funds
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
@travetto/boot
Advanced tools
Install: @travetto/boot
npm install @travetto/boot
Boot is basic environment awareness coupled with typescript bootstrapping for Travetto apps and libraries. It has support for the following key areas:
The functionality we support for testing and retrieving environment information:
isTrue(key: string): boolean;
- Test whether or not an environment flag is set and is trueisFalse(key: string): boolean;
- Test whether or not an environment flag is set and is falseisSet(key:string): boolean;
- Test whether or not an environment value is set (excludes: null
, ''
, and undefined
)get(key: string, def?: string): string;
- Retrieve an environmental value with a potential defaultgetInt(key: string, def?: number): number;
- Retrieve an environmental value as a numbergetList(key: string): string[];
- Retrieve an environmental value as a listgetTime(key: string, def: number):number
- Reads an environment variable as milliseconds, with support for s
, m
, and h
suffixes to provide succinct time units.The framework uses a file cache to support it's compilation activities for performance. This cache is also leveraged by other modules to support storing of complex calculations. AppCache is the cache that is used specific to the framework, and is an instance of FileCache. FileCache is the generic structure for supporting a file cache that invalidates on modification/creation changes.
The class organization looks like:
Code: File Cache Structure
/// <reference types="node" />
import * as fs from 'fs';
/**
* Standard file cache, with output file name normalization and truncation
*/
export declare class FileCache {
private cache;
readonly cacheDir: string;
/**
* Directory to cache into
*/
constructor(cacheDir: string);
init(): void;
/**
* Write contents to disk
* @param local Local location
* @param contents Contents to write
*/
writeEntry(local: string, contents: string | Buffer): void;
/**
* Read entry from disk
* @param local Read the entry given the local name
*/
readEntry(local: string): string;
/**
* Delete expired entries
* @param full The local location
* @param force Should deletion be force
*/
removeExpiredEntry(local: string, force?: boolean): void;
/**
* Delete entry
* @param local The location to delete
*/
removeEntry(local: string): void;
/**
* Checks to see if a file has been loaded or if it's available on disk
* @param local The location to verify
*/
hasEntry(local: string): true | fs.Stats | undefined;
/**
* Retrieve fs.Stats of the associated path
* @param local The location to stat
*/
statEntry(local: string): fs.Stats;
/**
* Clear cache
* @param quiet Should the clear produce output
*/
clear(quiet?: boolean): void;
/**
* Map entry file name to the original source
* @param entry The entry path
*/
fromEntryName(entry: string): string;
/**
* Map the original file name to the cache file space
* @param local Local path
*/
toEntryName(local: string): string;
/**
* Get or set a value (from the create function) if not in the cache
* @param local The local location
* @param create The method to execute if the entry is not found
* @param force Should create be executed always
*/
getOrSet(local: string, create: () => string, force?: boolean): string;
}
Everything is based on absolute paths being passed in, and translated into cache specific files.
This functionality allows the program to opt in the typescript compiler. This allows for run-time compilation of typescript files.
FsUtil provides some high level functionality (like recursive directory delete).
ScanFs provides a breadth-first search through the file system with the ability to track and collect files via patterns.
Just like child_process, the ExecUtil exposes spawn
and fork
. These are generally wrappers around the underlying functionality. In addition to the base functionality, each of those functions is converted to a Promise
structure, that throws an error on an non-zero return status.
A simple example would be:
Code: Running a directory listing via ls
import { ExecUtil } from '@travetto/boot/src';
export async function executeListing() {
const { result } = ExecUtil.spawn('ls');
const final = await result;
console.log(final.stdout.split('\n'));
}
As you can see, the call returns not only the child process information, but the Promise
to wait for. Additionally, some common patterns are provided for the default construction of the child process. In addition to the standard options for running child processes, the module also supports:
timeout
as the number of milliseconds the process can run before terminating and throwing an errorquiet
which suppresses all stdout/stderr outputstdin
as a string, buffer or stream to provide input to the program you are running;timeoutKill
allows for registering functionality to execute when a process is force killed by timeoutThe StreamUtil class provides basic stream utilities for use within the framework:
toBuffer(src: Readable | Buffer | string): Promise<Buffer>
for converting a stream/buffer/filepath to a Buffer.toReadable(src: Readable | Buffer | string):Promise<Readable>
for converting a stream/buffer/filepath to a ReadablewriteToFile(src: Readable, out: string):Promise<void>
will stream a readable into a file path, and wait for completion.waitForCompletion(src: Readable, finish:()=>Promise<any>)
will ensure the stream remains open until the promise finish produces is satisfied.The module provides the ability to clear the compilation cache to handle any inconsistencies that may arise.
Terminal: Clean operation
$ travetto travetto clean --help
Usage: clean [options]
Options:
-q, --quiet Quiet operation
-h, --help display help for command
FAQs
Bootstrapping and common utilities for travetto applications.
We found that @travetto/boot demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
Security News
Research
Socket researchers have discovered malicious npm packages targeting crypto developers, stealing credentials and wallet data using spyware delivered through typosquats of popular cryptographic libraries.
Security News
Socket's package search now displays weekly downloads for npm packages, helping developers quickly assess popularity and make more informed decisions.