
Research
Security News
Malicious PyPI Package Exploits Deezer API for Coordinated Music Piracy
Socket researchers uncovered a malicious PyPI package exploiting Deezer’s API to enable coordinated music piracy through API abuse and C2 server control.
@trint/y-mongo
Advanced tools
Persistent Mongodb storage for y-websocket server
npm install @trint/y-mongo --save
const http = require('http');
const WebSocket = require('ws');
const Y = require('yjs');
const { MongodbPersistence } = require('y-mongodb');
const utils = require('y-websocket/bin/utils.js');
const location = process.env.MONGODB_URI;
const collection = 'yjs-transactions';
const ldb = new MongodbPersistence(location, collection);
const production = process.env.PRODUCTION != null;
const port = process.env.PORT || 8080;
const server = http.createServer((request, response) => {
response.writeHead(200, { 'Content-Type': 'text/plain' });
response.end('okay');
});
// const wss = new WebSocket.Server({ server });
const wss = new WebSocket.Server({ noServer: true });
wss.on('connection', utils.setupWSConnection);
server.on('upgrade', (request, socket, head) => {
// You may check auth of request here..
/**
* @param {any} ws
*/
const handleAuth = ws => {
wss.emit('connection', ws, request)
}
wss.handleUpgrade(request, socket, head, handleAuth)
});
/*
Persistence must have the following signature:
{ bindState: function(string,WSSharedDoc):void, writeState:function(string,WSSharedDoc):Promise }
*/
utils.setPersistence({
bindState: async (docName, ydoc) => {
// Here you listen to granular document updates and store them in the database
// You don't have to do this, but it ensures that you don't lose content when the server crashes
// See https://github.com/yjs/yjs#Document-Updates for documentation on how to encode
// document updates
const persistedYdoc = await ldb.getYDoc(docName);
const newUpdates = Y.encodeStateAsUpdate(ydoc);
ldb.storeUpdate(docName, newUpdates)
Y.applyUpdate(ydoc, Y.encodeStateAsUpdate(persistedYdoc));
ydoc.on('update', async update => {
ldb.storeUpdate(docName, update);
})
},
writeState: async (docName, ydoc) => {
// This is called when all connections to the document are closed.
// In the future, this method might also be called in intervals or after a certain number of updates.
return new Prosime(resolve => {
// When the returned Promise resolves, the document will be destroyed.
// So make sure that the document really has been written to the database.
resolve()
})
}
})
server.listen(port);
console.log(`Listening to http://localhost:${port} ${production ? '(production)' : ''}`)
persistence = MongodbPersistence(mongoUril, collection)
Create a mongo persistence instance.
persistence.getYDoc(docName: string): Promise<Y.Doc>
Create a Y.Doc instance with the data stored in mongodb.
persistence.storeUpdate(docName: string, update: Uint8Array): Promise
Store a transaction to the database.
persistence.clearDocument(docName: string): Promise
Delete a document, and all associated data from the database.
FAQs
Mongodb adapter for Yjs
We found that @trint/y-mongo demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 24 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket researchers uncovered a malicious PyPI package exploiting Deezer’s API to enable coordinated music piracy through API abuse and C2 server control.
Research
The Socket Research Team discovered a malicious npm package, '@ton-wallet/create', stealing cryptocurrency wallet keys from developers and users in the TON ecosystem.
Security News
Newly introduced telemetry in devenv 1.4 sparked a backlash over privacy concerns, leading to the removal of its AI-powered feature after strong community pushback.