Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
blue-rings
Advanced tools
The goal is to provide distributed counters usable for billing, with:
The underlying protocol is currently Axon, a lightweight, native alternative to ZeroMQ on Node.js.
The module also provides "last-writer wins" text registers.
const BlueRings = require('blue-rings')
const ring = BlueRings(options);
The options
parameter is required; available parameters are:
options.host
(required), a string uniquely identifying this host (but normally shorter than the hostname, to reduce memory and bandwidth usage);options.subscribe_to
, an Array containing one or more tcp://ip:port/
strings suitable to connect to remote Axon/Blue-Rings servers (default remote port is 4000, see below);options.pub
, a port number or tcp://0.0.0.0:port/
string suitable to bind the local Axon publisher (the default will bind on port 4000 on all interfaces);options.forward_delay
, the number of milliseconds to wait for no updates on a counter before forwarding an update (default: 1000ms);options.connect_delay
, the number of milliseconds to wait for no updates on a counter before sending a full update, when a remote server connects (default: 1500ms);options.Value
, an object describing how numerical values are interpreted and transmitted.subscribe_to
At this time it is recommended that if server A has an entry subscribe_to
pointing to server B, server B should have an entry subscribe_to
pointing to server A. In other words subscriptions should be symmetrical. Not doing so would allow you to implement fun topologies (such as a ring) which would also prove very inefficient. This limitation might be removed at some future point if the underlying protocol is changed from Axon to a custom-crafted protocol.
You can also for example implement receiver-only
schemes by not setting subscribe_to
; the server will receive updates but not propagate any local changes.
Also note that a server might be subscribed-to other servers and not update counters on its own; in this case it is used only as a message router.
The timers forward_delay
and connect_delay
are set by default to values adequate for a full-mesh or near-full-mesh setup. If your topology of choice is different, which is probably the case beyond a handful of servers since full-mesh will not scale much, the timers will need to be adapted based on which role you give each server; there are examples in the test suite, and here are some guidelines:
forward_delay
should be kept very low (i.e. 0 or 1ms) to ensure quick propagation of updates;flood_delay
should be kept relatively low (200ms for example) to ease convergence;The Value
option defaults to providing EcmaScript integers as numerical values. Since Node.js 10.7.0 BigInt is also supported natively, and can be activated by using options.Value = BlueRings.bigint
(the default is the equivalent of options.Value = BlueRings.integer
).
Here is an example for a service storing Big Integers (arbitrary precision integers).
options.Value = BlueRings.bigint
const ring = BlueRings(options);
ring.setup_counter(name,expire) →
ring.update_counter(name,amount) → [coherent,new_value]
ring.get_counter(name) → [coherent,value]
This implements a counter name
by adding value amount
, keeping it until expire
. Returns a boolean indicating whether the network is coherent (not-split etc.) and a number representing the new value of the counter.
Note that amount
, new_value
, value
are of the type specified by the Value
option; by default they are native Javascript numbers but might be BigInt
, bigRat
, etc.
ring.setup_text(name,expire) →
ring.update_text (name,text) → [coherent,new_value]
ring.get_text(name) → [coherent,value]
This implements a Last Writer Wins text register, keeping it until expire
.
ring.statistics() -> {recv,recv_tickets,sent,sent_tickets}
ring.end()
stops all connections and cleans up.
All methods are synchronous.
ring.bound
is a Promise that resolves once the server is bound.
ring.connected
is a Promise that resolves the first time all the remote connections (in options.subscribe_to
) are successfully established.
Each counter is treated as an independent database; the database contains a series of tickets which represents changes to the counter's value.
Each API request is stored uniquely in the distributed database for counter name
as
ticket(timestamp,host,amount)
Each ticket must be globally unique: tickets with identical contents are considered identical.
The protocol uses two packet types:
ping()
is used to detect failures in remotes (and compute the coherent
boolean flag);new-tickets(name,expire,hash,array-of-tickets)
is used to transmit changes to the database.FAQs
Blue Rings: distributed counters
The npm package blue-rings receives a total of 2 weekly downloads. As such, blue-rings popularity was classified as not popular.
We found that blue-rings demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.