Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
barefoot is a utility-belt library for Node for asynchronous functions manipulation
Barefoot is a utility-belt library for Node for asynchronous functions manipulation
To install it
npm install barefoot
To use it
bf = require 'barefoot'
lateral = require 'lateral'
_ = require 'underscore'
toDictionary
Transform an array of object into a dictionary based on the property passed as a second param
toDictionary = (array, prop) ->
dictionary = {}
array.forEach (elt) ->
dictionary[elt[prop]] = elt if elt? and elt[prop]?
return dictionary
has
Provides a function which test if parameters object has certain properties
has = (parameters) ->
(params, done) ->
ok = true
ok = (ok and params? and params[par]?) for par in parameters
done (if ok then null else new Error("Missing Parameters")), params
amap
Asynchronous map Use the awesome lateral module to do the job
amap = (func, nbProcesses = 1) ->
(array, done) ->
results = []
errors = null
unit = lateral.create (complete, item) ->
func item, (err, res) ->
if err?
errors ?= []
errors.push(err)
results.push null
else
results.push res
complete()
, nbProcesses
unit.add(array).when () ->
done errors, results
chain
Chain aynschronous methods with signature (val, done) -> done(err, result) Stop if one of the method has an error in the callback
chain = (funcs) ->
(val, done) ->
if funcs.length == 0
done null, val
else
funcs[0] val, (err, res) =>
if err?
done err, res
else
chain(funcs[1..])(res, done)
avoid
Wrap a void returning function to make it callable in a chain
avoid = (func) ->
(params, done) ->
func(params)
done null, params
parallel
Execute asynchronous functions which take same inputs
parallel = (funcs) ->
(params, done) ->
i = 0
errors = []
results = []
tempDone = (err, result) ->
i++
errors.push(err) if err?
results.push result
if i == funcs.length
error = if errors.length > 0 then errors else null
done error, results
funcs.forEach (func) ->
func params, tempDone
getRequestParams
getRequestParams = (req) ->
params = {}
for field in ["body", "query", "params"]
if req[field]?
params = _.extend params, req[field]
params.user = req.user if req.user?
params
webService
webService = (method, contentType = "application/json") ->
(req, res) ->
method getRequestParams(req), (err, data) ->
if err?
res.send 500
else
if contentType == "application/json"
res.send data
else
res.contentType contentType
res.end data.toString()
webPage
webPage = (template, method) ->
(req, res) ->
if not method? and template?
data = getRequestParams(req)
data.__ =
template : template
res.render template, data
else
method getRequestParams(req), (err, data) ->
if err?
res.send 500
else
data = {} if not data?
data.user = req.user if req.user? and not data.user?
data.__ =
template : template
res.render template, data
memoryCache
memoize = (method, seconds) ->
cache = {}
(params, done) ->
hash = JSON.stringify(params)
if cache[hash]? and cache[hash].expiration > new Date()
done null, cache[hash].result
else
method params, (err, res) ->
if not err?
cache[hash] =
result : res
expiration : (new Date()).setSeconds((new Date()).getSeconds() + seconds)
done err, res
module.exports =
toDictionary : toDictionary
has : has
amap : amap
chain : chain
avoid : avoid
parallel : parallel
webService : webService
webPage : webPage
memoize : memoize
FAQs
barefoot is a utility-belt library for Node for asynchronous functions manipulation
The npm package barefoot receives a total of 0 weekly downloads. As such, barefoot popularity was classified as not popular.
We found that barefoot demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.