
Research
Security News
Malicious PyPI Package Exploits Deezer API for Coordinated Music Piracy
Socket researchers uncovered a malicious PyPI package exploiting Deezer’s API to enable coordinated music piracy through API abuse and C2 server control.
Provides a very concise implementaiton of ESC to be used with IcedCoffeeScript's autocb feature.
Design goals:
Features:
See below for a detailed explanation of this package and Error Short Circuiters in general.
Installation:
npm install autoesc
Consider the following function that reads a file, parses it and does some processing:
myAsyncFunc1 = (path, callback) ->
await fs.readFile(path, 'utf8', defer(err, raw))
if err then return callback(err)
try
data = JSON.parse(raw)
catch e
return callback(e)
await Image.findById(data.imageId, defer(err, image))
if err then return callback(err)
await checkPermissions(globalUser, image, defer(err, permitted))
if err then return callback(err)
if !permitted
return callback(new Error('access denied'))
callback null, image
It's a mess, and a popular way to deal with it is to use an Error Short Circuiter (ESC).
One good implementation is errTo, resulting in the following code:
errTo = require('errto')
myAsyncFunc2 = (path, callback) ->
await fs.readFile(path, 'utf8', errTo(callback, defer raw))
try
data = JSON.parse(raw)
catch e
return callback(e)
await Image.findById(data.imageId, errTo(callback, defer image))
await checkPermissions(globalUser, image, errTo(callback, defer permitted))
if !permitted
return callback(new Error('access denied'))
callback null, image
That's much better, but you can make the code more concise by binding errTo:
errTo = require('errto')
myAsyncFunc3 = (path, callback) ->
esc = errTo.bind(null, callback)
await fs.readFile(path, 'utf8', esc defer raw)
try
data = JSON.parse(raw)
catch e
return callback(e)
await Image.findById(data.imageId, esc defer image)
await checkPermissions(globalUser, image, esc defer permitted)
if !permitted
return callback(new Error('access denied'))
callback null, image
This package allows you to write:
esc = require('autoesc')
myAsyncFunc4 = esc (path, autocb) ->
await fs.readFile(path, 'utf8', autocb defer raw)
data = JSON.parse(raw)
await Image.findById(data.imageId, autocb defer image)
await checkPermissions(globalUser, image, autocb defer permitted)
if !permitted
throw new Error('access denied')
return image
Now, this is not for everyone; some may feel there's too much magic involved. Also:
The advantage is that there's no way to screw up callbacks and error handling with autocb + autoesc:
esc = require('autoesc')
esc
.autocb
to let IcedCoffeeScript invoke callbacks for you.autocb
to defer
to automatically handle errors.Copyright 2014, Andrey Tarantsov. Licensed under MIT.
FAQs
Error Short Circuiter (ESC) function decorator
We found that autoesc demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket researchers uncovered a malicious PyPI package exploiting Deezer’s API to enable coordinated music piracy through API abuse and C2 server control.
Research
The Socket Research Team discovered a malicious npm package, '@ton-wallet/create', stealing cryptocurrency wallet keys from developers and users in the TON ecosystem.
Security News
Newly introduced telemetry in devenv 1.4 sparked a backlash over privacy concerns, leading to the removal of its AI-powered feature after strong community pushback.