
Research
Security News
Lazarus Strikes npm Again with New Wave of Malicious Packages
The Socket Research Team has discovered six new malicious npm packages linked to North Korea’s Lazarus Group, designed to steal credentials and deploy backdoors.
arc-server
Advanced tools
The arc-server
api is split into 3 submodules:
arc-server
import { withFlags, setFlags, getFlags } from "arc-server";
setFlags(flags): void
: sets arc flags for the current synchronous execution and then persists the flags through any following asynchronous calls.withFlags<T>(flags, fn: () => T): T
: sets arc flags for the synchronous execution of the provided fn
and then persists the flags through asynchronous calls made within the provided fn
. Returns the result of calling fn
.getFlags(): Record<string, boolean> | undefined
: gets the currently set flags or undefined.import { setFlags, getFlags } from "arc-server";
function start(flags, delay) {
setFlags(flags);
wait(delay);
}
function wait(delay) {
setTimeout(logFlags, delay);
}
function logFlags() {
// The flags weren't passed here, but we can get them from the context
console.log(getFlags());
}
start({ foo: true }, 100);
start({ baz: true }, 10);
start({ baz: true }, 50);
// After 10ms, { bar:true } is logged
// After 50ms, { baz:true } is logged
// After 100ms, { foo:true } is logged
import { withFlags, getFlags } from "arc-server";
function start(flags, delay) {
withFlags(flags, () => {
wait(delay);
});
}
function wait(delay) {
setTimeout(logFlags, delay);
}
function logFlags() {
// The flags weren't passed here, but we can get them from the context
console.log(getFlags());
}
start({ foo: true }, 100);
start({ baz: true }, 10);
start({ baz: true }, 50);
// After 10ms, { bar:true } is logged
// After 50ms, { baz:true } is logged
// After 100ms, { foo:true } is logged
Example usage in example-arc-server/index.js
arc-server/install
import "arc-server/install";
If you are not bundling your server files with another arc
plugin, you should import
/require
this module near the beginning of your application entry point before loading any modules that need to be adaptable.
arc-server/proxy
import createAdaptiveProxy from "arc-server/proxy";
An AdaptiveProxy
is returned from an import
/require
call. It can be treated as if it were the underlying module (with a few caveats. You probably won't need to use this module directly.
createAdaptiveProxy(matches)
matches
: a MatchSet
where each value is the loaded moduleApplies if you require an adaptive file that sets exports
to a primitive value:
module.exports = "Hello World";
Proxy and Reflect are used to provide adaptive values, but these do not support primitive values (string
, number
, boolean
).
To work around this, these primitives are converted into instances of String
, Number
, or Boolean
. In many cases, you will be able to treat this as if it were the original value, but there are differences.
One notable example is truthiness:
// Objects are truthy, regardless of value
!!new Boolean(false) === true;
!!new String("") === true;
!!new Number(0) === true;
Another is typeof
:
// typeof is object, regardless of value
typeof new Boolean(true) === "object";
typeof new String("hello") === "object";
typeof new Number(10) === "object";
If you need a true primitive, you can convert an adaptive primitive to its resolved primitive value using valueOf
:
let string = adaptiveString.valueOf();
Native functions, eg from Object.prototype
, or String.prototype
are bound to the adapted object:
let valueOf = adaptiveValue.valueOf;
// works because it is bound
valueOf();
// this doesn't change, because it was previously bound
valueOf.bind(newThis);
FAQs
<img src="https://img.shields.io/github/license/eBay/ar
We found that arc-server demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
The Socket Research Team has discovered six new malicious npm packages linked to North Korea’s Lazarus Group, designed to steal credentials and deploy backdoors.
Security News
Socket CEO Feross Aboukhadijeh discusses the open web, open source security, and how Socket tackles software supply chain attacks on The Pair Program podcast.
Security News
Opengrep continues building momentum with the alpha release of its Playground tool, demonstrating the project's rapid evolution just two months after its initial launch.