
Research
/Security News
9 Malicious NuGet Packages Deliver Time-Delayed Destructive Payloads
Socket researchers discovered nine malicious NuGet packages that use time-delayed payloads to crash applications and corrupt industrial control systems.

Fibonacci and exponential backoffs for Node.js.
npm install backoff
In order to use backoff, require backoff.
var backoff = require('backoff');
The usual way to instantiate a new Backoff object is to use one predefined
factory method: backoff.fibonacci([options]), backoff.exponential([options]).
Backoff inherits from EventEmitter. When a backoff starts, a backoff
event is emitted and, when a backoff ends, a ready event is emitted.
Handlers for these two events are called with the current backoff number and
delay.
var fibonacciBackoff = backoff.fibonacci({
randomisationFactor: 0,
initialDelay: 10,
maxDelay: 1000
});
fibonacciBackoff.on('backoff', function(number, delay) {
// Do something when backoff starts.
console.log(number + ' ' + delay + 'ms');
});
fibonacciBackoff.on('ready', function(number, delay) {
// Do something when backoff ends.
if (number < 15) {
fibonacciBackoff.backoff();
}
});
fibonacciBackoff.backoff();
The previous example would print:
0 10ms
1 10ms
2 20ms
3 30ms
4 50ms
5 80ms
6 130ms
7 210ms
8 340ms
9 550ms
10 890ms
11 1000ms
12 1000ms
13 1000ms
14 1000ms
15 1000ms
Backoff objects are meant to be instantiated once and reused several times
by calling reset after a successful "retry".
Constructs a Fibonacci backoff (10, 10, 20, 30, 50, etc.).
See bellow for the options description.
Constructs an exponential backoff (10, 20, 40, 80, etc.).
The options are:
With these values, the backoff delay will increase from 100 ms to 10000 ms. The randomisation factor controls the range of randomness and must be between 0 and 1. By default, no randomisation is applied on the backoff delay.
Constructs a new backoff object from a specific backoff strategy. The backoff
strategy must implement the BackoffStrategyinterface defined bellow.
Starts a backoff operation. Will throw an error if a backoff operation is already in progress.
In practice, this method should be called after a failed attempt to perform a sensitive operation (connecting to a database, downloading a resource over the network, etc.).
Resets the backoff delay to the initial backoff delay and stop any backoff operation in progress. After reset, a backoff instance can and should be reused.
In practice, this method should be called after having successfully completed the sensitive operation guarded by the backoff instance or if the client code request to stop any reconnection attempt.
Emitted when a backoff operation is started. Signals to the client how long the next backoff delay will be.
Emitted when a backoff operation is done. Signals that the failing operation should be retried.
A backoff strategy must provide the following methods.
Computes and returns the next backoff delay.
Resets the backoff delay to its initial value.
Exponential (10, 20, 40, 80, etc.) backoff strategy implementation.
The options are:
Fibonnaci (10, 10, 20, 30, 50, etc.) backoff strategy implementation.
The options are:
This code is free to use under the terms of the MIT license.
1.0.0
start and done events backoff and ready.backoff.fibonnaci.The 'retry' package provides a similar functionality to 'backoff' by allowing you to retry operations with configurable strategies. It supports exponential backoff, custom retry strategies, and error handling. Compared to 'backoff', 'retry' offers a more flexible API for defining custom retry logic.
The 'promise-retry' package is designed for retrying operations that return promises. It provides a simple API for retrying promise-based operations with configurable retry strategies, including exponential backoff. Compared to 'backoff', 'promise-retry' is more focused on promise-based workflows.
The 'async-retry' package is another alternative that supports retrying asynchronous operations with configurable strategies. It works well with both promises and async/await syntax. Compared to 'backoff', 'async-retry' offers a more modern API that integrates seamlessly with async/await.
FAQs
Fibonacci and exponential backoffs.
The npm package backoff receives a total of 525,136 weekly downloads. As such, backoff popularity was classified as popular.
We found that backoff demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Socket researchers discovered nine malicious NuGet packages that use time-delayed payloads to crash applications and corrupt industrial control systems.

Security News
Socket CTO Ahmad Nassri discusses why supply chain attacks now target developer machines and what AI means for the future of enterprise security.

Security News
Learn the essential steps every developer should take to stay secure on npm and reduce exposure to supply chain attacks.