
Security News
/Research
Wallet-Draining npm Package Impersonates Nodemailer to Hijack Crypto Transactions
Malicious npm package impersonates Nodemailer and drains wallets by hijacking crypto transactions across multiple blockchains.
This project is currently very early development, and I wouldn't recommend it for production. Feel free to use it as you like and if you find any problems then submit an issue via github issues tab.
Note
This project is currently very early development, and I wouldn't recommend it for production. Feel free to use it as you like and if you find any problems then submit an issue via github issues tab.
Features/Roadmap
bun a buxt
Starting a basic server with the default values
//index.ts
import CreateServer from "buxt";
await CreateServer(3000).then(s => s.listen());
//routes/example_endpoint.ts
import type { BuxtRequest, BuxtResponse } from "buxt"; //typings arent required, but useful!
export default async function(req: BuxtRequest, res: BuxtResponse) {
res.send("Hello!");
}
Thats it!
By default, the app will search for exported functions under <project-root>/routes and <project-root>/src/routes, unless specified when creating the server.
Aside from the previous example, there are three other ways of creating and starting a buxt server:
//index.ts
import CreateServer from "buxt";
const server = await CreateServer(3000);
await server.listen();
//index.ts
import CreateServer from "buxt";
const server = await CreateServer(3000, "src/api");
await server.listen();
//index.ts
import CreateServer from "buxt";
const server = await CreateServer({
port: 3000,
routeRoot: "api",
cors: true,
corsConfig: {
origins: [ "*" ]
}
});
await server.listen();
type BuxtConfig = {
port: number,
routeRoot: string,
cors?: boolean = false,
corsConfig?: CorsConfig = null
}
type CorsConfig = {
origins: string[],
allowedMethods?: HttpMethod[] = ["GET", "OPTIONS", "POST"]
}
type HttpMethod = "GET" | "POST" | "PUT" | "DELETE" | "OPTIONS" | "HEAD" | "PATCH";
Route parameters work like they do in Next.js - they're denoted by a variable name surrounded by square brackets, eg: routes/user/[user].ts
They can then be accessed on the BuxtRequest object under req.routeParameters.{variable_name}
//routes/user/[user].ts
import type { BuxtRequest, BuxtResponse } from "buxt";
export default async function(req: BuxtRequest, res: BuxtResponse) {
res.send("Hello " + req.routeParameters.user);
}
You must create a server using a config object to enable cors responses.
//index.ts
import CreateServer from "buxt";
const server = await CreateServer({
port: 3000,
routeRoot: "api",
cors: true,
corsConfig: {
origins: [ "localhost:3000", "localhost:3001", "https://miaz.xyz/", "http://miaz.xyz" ],
allowedMethods: [ "GET", "POST", "OPTIONS", "PUT", "DELETE"]
}
});
Firstly, make sure the cors key is set to true
, then pass in a CorsConfig
object. The CorsConfig
's origins
key cannot be null. If you're allowing all origins then simply make it a single item array with ["*"]
.
Reminder that you cannot combine wildcard routes and non-wildcard routes; if you attempt to do this then it will throw an error.
FAQs
This project is currently very early development, and I wouldn't recommend it for production. Feel free to use it as you like and if you find any problems then submit an issue via github issues tab.
The npm package buxt receives a total of 0 weekly downloads. As such, buxt popularity was classified as not popular.
We found that buxt demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
/Research
Malicious npm package impersonates Nodemailer and drains wallets by hijacking crypto transactions across multiple blockchains.
Security News
This episode explores the hard problem of reachability analysis, from static analysis limits to handling dynamic languages and massive dependency trees.
Security News
/Research
Malicious Nx npm versions stole secrets and wallet info using AI CLI tools; Socket’s AI scanner detected the supply chain attack and flagged the malware.