Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
12factor.net web app platform for node.js, built on express 3
$ sudo npm install -g base12
$ base12 new projectname && cd projectname
$ make open
$ make setup
$ make simple
$ make open
$ make run
$ make run 1
$ make cycle
$ make cycle 1
$ make profile
prof_lazy
option $ make profile-lazy
$ make debug
$ make debug-brk
Production-ready
Cloud Deployments
Structure
Express 3
Not Rails
assets -- place to store assets for project (graphics, src files, etc.)
components -- place to store components for small piecs of functionality in app
/dashboard -- default dashboard example component
/errors -- default component for handling server errors
/user -- default component for user functionality using mvc pattern (signup, signin, signout, settings)
doc -- documentation
lib -- app specific and non-npm-published node.js libraries
/balance -- uses cluster to create and blance multiple processes
/config-load -- loads available config files
/flash -- flash messaging
/inject --
/locals -- add resuable local helpers to app views
/middleware -- sets up express middleware (stylus, sessions, logs)
/mongoose -- connects mongoose to mongodb
/mongoose-util -- provides mongoose helpers (validations, plugins, etc)
/redis -- provides app-wide redis connection
/reload -- watches for file changes and reloads app
public -- static files are hosted here
scripts -- scripts (eg admin, deployment, migrations)
test -- tests (mocha by default)
tmp -- your app can store temporary files here
app.js -- runs your app
config.default.js -- default config (no sensative passwords or location specific options)
config.local.js -- local config (ignored by git, create to store sensative information and location specific options)
config.test.js -- config for running tests
Makefile -- automated task makefile
package.json -- npm package.json
All base12 components have the same signature:
module.exports = function(app) {
// ...
return my_module;
}
The component or lib is responsible for supplying the app with the needed interface hooks. For example, a component might look like:
module.exports = function(app) {
app.get('/dashboard', function(req, res) {
return res.render(require('path').join(__dirname, 'dashboard'), {
user: req.session.user
});
});
};
Application constants (values that do not change from machine to machine) are located in config.default.js
.
module.exports = {
http_port: 3000,
cluster: true,
request_timeout: 100000,
session_secret: "base12secret",
log_requests: false,
stylus_compress: 1,
stylus_debug: 1,
stylus_force: 1,
test: false,
redis_host: "localhost",
redis_port: 6379,
redis_pass: "",
redis_debug: false,
mongoose_url: "mongodb://localhost/base12"
};
Environment config (values that can change from machine to machine) are located in config.local.js
, which is not tracked by git.
You can create this file whenever needed and it values will override the defaults if both exist.
module.exports = {
http_port: 80,
mongoose_url: "mongodb://username:passsword@127.0.0.1/base12"
};
"One codebase tracked in version control, many deploys."
Base12 uses git-based deployments exclusively.
"Explicitly declare and isolate dependencies."
Base12 uses npm install
both locally and in deploys to manage dependencies.
Manage your dependencies in package.json
.
"Store config in the environment."
Base12 uses the untracked config.local.js file to manage environment config. Once tooling is better supported on hosts, it will likely move to environment variables.
"Treat backing services as attached resources."
Backing service configuration is stored in config.local.js on each host.
"Strictly separate build and run stages."
make build
builds a base12 app's assetes, while make run
executes it. make cycle
watches local files and cycles between build and run phases for rapid development.
"Execute the app as one or more stateless processes."
Base12 apps are stateless. The built-in session manager is backed by redis, and apps can be run as any number of independent processes forked from app.js. The directory structure provides /tmp for temporary file manipulation, but provides no permanent file storage mechanism since that should be done through a backing service.
"Export services via port binding."
Ultimately, base12 relies on node's built-in http server to field requests. No http container or helper is needed.
"Scale out via the process model."
Using deployment-specific process managers (eg, upstart), base12 keeps the master node.js process running.
In run.js, base12.balance
uses cluster to spawn and monitor multiple processes on a single machine.
New process types can be created by writing modules with a start()
method, and passing that process module to base12.balance()
in run.js.
"Maximize robustness with fast startup and graceful shutdown."
Base12 uses a crash-only design. Uncaught errors exit the process, triggering the balancer to replace it. Startup is nearly immediate.
"Keep development, staging, and production as similar as possible."
We encourage you to keep your config.local.js configurations as similar as possible across machines to maximize parity.
"Treat logs as event streams."
Base12 logs events directly to stdout and stderr.
"Run admin/management tasks as one-off processes."
All admin processes are handled with scripts in the /scripts directory. Built-in scripts include provisioning and deployment, tests, dependency management, and generators.
Copyright (c) 2013, Skookum Digital Works
All rights reserved.
Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
FAQs
12factor.net app platform for node.js, built on express 3
The npm package base12 receives a total of 26 weekly downloads. As such, base12 popularity was classified as not popular.
We found that base12 demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 3 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.