
Security News
/Research
Wallet-Draining npm Package Impersonates Nodemailer to Hijack Crypto Transactions
Malicious npm package impersonates Nodemailer and drains wallets by hijacking crypto transactions across multiple blockchains.
Document entity framework
Bookworm is an isomorphic library that helps organizing the application’s model layer into a document oriented structure. Through entity classes the Bookworm API allows for access and modification of sntls.Tree-based cache nodes. Instead of using absolute paths, Bookworm entities may be accessed relying only on their identifiers (keys).
The document oriented structure means that the model layer is organized into these units:
DocumentKey
instance identifies a documentDocument
class implements its APIDocument
FieldKey
instance identifies a fieldField
, CollectionField
, and OrderedCollectionField
classes implement its APIItemKey
instance identifies an itemItem
class implements its APIFields and collection items may have the ‘reference’ type, pointing to other entities. (Common application is the collection of references.)
The Bookworm entity store is an in-memory datastore based on sntls.Tree.
The cache is composed of three containers:
bookworm.entities
: Contains all entities within the application. Entity classes provide access to the contents of this container.bookworm.config
: Contains configuration information, most importantly field and collection item types. Look in js/cache/config.js or the non-minified distribution for the structure. The contents of this container is expected to be initialized before those parts of the application that use the Bookworm API.bookworm.index
: Holds user-defined indexes for lookups, search, etc. No structure is imposed on this container, content is completely up to the application implementation.Entity keys, such as DocumentKey
, FieldKey
, and ItemKey
, are evented. You may trigger and capture events on them. The library itself triggers events on keys whenever a corresponding entity is accessed (when absent) or changed.
‘user/1234/name’.toField().setValue(“John Smith”);
Will set the value “John Smith” on the node in bookworm.entities
(instance of sntls.Tree
) on the path that corresponds to the field ‘user/1234/name’. By default, this is mapped to the path ’document>documentType>documentId>fieldName’.toPath()
, but the mapping may be changed by subclassing FieldKey
and providing a suitable surrogate.
!!’user/1234’.toDocument().getSilentNode();
Will not trigger access event signaling that the node is missing. Use .getNode()
to allow access events to be triggered.
var userKey = ‘user/1234’.toDocumentKey(),
nameKey = userKey.getFieldKey(‘name’);
is the same as:
var nameKey = ‘user/1234/name’.toFieldKey();
'foo/bar'.toDocumentKey()
.subscribeTo(bookworm.Entity.EVENT_ENTITY_CHANGE, function (event) {
console.log("Entity " + event.sender + " changed.");
console.log("Was: " + event.beforeNode);
console.log("Now: " + event.afterNode);
});
FAQs
Document entity framework
The npm package bookworm receives a total of 6 weekly downloads. As such, bookworm popularity was classified as not popular.
We found that bookworm demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
/Research
Malicious npm package impersonates Nodemailer and drains wallets by hijacking crypto transactions across multiple blockchains.
Security News
This episode explores the hard problem of reachability analysis, from static analysis limits to handling dynamic languages and massive dependency trees.
Security News
/Research
Malicious Nx npm versions stole secrets and wallet info using AI CLI tools; Socket’s AI scanner detected the supply chain attack and flagged the malware.