
Research
Malicious fezbox npm Package Steals Browser Passwords from Cookies via Innovative QR Code Steganographic Technique
A malicious package uses a QR code as steganography in an innovative technique.
calvium-node-api-lib
Advanced tools
This repo contains common code for API servers that we write:
Historically, this code has all come from projects in which we provided the entire vertical - API server, webapp and mobile app.
This is not a framework, it's just a library. Users opt into features individually by calling them.
This library has two sets of tests:
npm install
and npm run test
.npm run test-integration
.You can set the following settings to 'y'
to get output for debugging:
SIMPLEQUERY_PRINT_QUERIES
to print every SQL query you execute.SIMPLEQUERY_PRINT_QUERY_ON_ERROR
to print SQL queries which fails.SIMPLEQUERY_PRINT_TIMINGS
to print how long each query took.SIMPLEQUERY_PRINT_TIMINGS_PARAMS
to print parameter names with the times (makes it easier to see which timing is for which SQL query).SIMPLEQUERY_DEBUG
to turn all of the above on at once.I would recommend setting SIMPLEQUERY_PRINT_QUERY_ON_ERROR
, SIMPLEQUERY_PRINT_TIMINGS
and SIMPLEQUERY_PRINT_TIMINGS_PARAMS
for development, then turn on SIMPLEQUERY_PRINT_QUERIES
when you're having specific problems with dynamically generated queries returning wrong results.
See the getDBConfigSync()
bit in examples/db.example.js
for how you'd could pass these in environment variables.
This library provides a binary called start-local-db
.
It is for starting up a local instance of SQL Server and then load your SQL schema into it.
To use it in your project:
sql/
sql/startLocalClean.sh
with contents like the following:#!/bin/sh
set -e
cd "$(dirname "$0")"
export CONTAINER_NAME="mssql-FILL_IN_PROJECT_NAME-dev"
export SQL_DATA_VARIANT="${1:-main}"
export AZ_MSSQL_PASSWORD="FILL_IN_DEFAULT_PASSWORD"
export AZ_MSSQL_DATABASE="FILL_IN_DATABASE_NAME"
# uses default 1433 if not defined
export AZ_MSSQL_PORT="FILL_IN_DB_PORT"
../node_modules/.bin/start-local-db "$@"
sql/original.sql
sql/migrations
with a filename like sql/migrations/0001-describe-change-here.sql
"start-local-db": "sh sql/startLocalDB.sh"
in the scripts
section of your package.json
.npm run start-local-db
to start the DB server.original.sql
, then load each of the migrations in ascending order.npm run start-local-db -- variant-name
instead. (See below.)You will probably want to load test data, separately from the migrations.
The start-local-db
script will load data files from several different subdirectories of sql/data
.
The data files must be numbered, with numbers that match up with a migration. The data files will be run just after the migration with the same number.
e.g. You might put CREATE TABLE unicorn (id bigint IDENTITY PRIMARY KEY, name nvarchar(64) NOT NULL);
in sql/migrations/0005-add-unicorns.sql
, then INSERT INTO unicorn (name) VALUES (N'Sammy the Iridescent Unicorn King');
in sql/data/test/common/0005-add-unicorn-sammy.sql
. The data file is run just after the migration, so that the table will be there for it to insert rows into
Files with the following patterns will be run:
sql/data/real/common/*.sql
sql/data/test/common/*.sql
sql/data/real/${variant-name}/*.sql
sql/data/test/${variant-name}/*.sql
The variant-name
is the first argument to start-local-db
. If you don't supply one, it defaults to the value you set in SQL_DATA_VARIANT
above. The idea of this is that you might have multiple variations of your test data.
For example, I might have two different test data files (say sql/data/test/unicorns/0005-add-unicorn-sammy.sql
and sql/data/test/goblins/0005-add-goblin-king-greg.sql
). When I run npm run start-local-db -- unicorns
, the files in sql/data/test/unicorns/*.sql
will be run and ones in sql/data/test/goblins/*.sql
will be ignored. The files in sql/data/test/common/*.sql
will always be run, regardless of which variant is selected.
start-local-db
may take snapshots of the SQL server instance partway through in order to save time next time you run it. The snapshots will show up in the output of docker images
. It's harmless to delete them. The snapshots are named based on the hashes of all the contents that went into them (a bit like how git SHAs depend on the contents of the files in each commit), so the script won't attempt to reuse a snapshot if it becomes inapplicable due to the source sql files having been changed.
You can disable this caching by running start-local-db
like env START_LOCAL_DB_IGNORE_CACHE=y npm run start-local-db
- this will prevent existing snapshots being used and prevent new snapshots from being taken. You hopefully shouldn't ever need to do this, though. Existing snapshots won't be reused if the SQL code that was used to create them is changed.
After running all other SQL, migration and data files, start-local-db
will run one last file, if it exists:
sql/postStartLocalDB.sql
If your example data files create entities in the database that expire over time, use sql/postStartLocalDB.sql
to reset all the timers on them.
FAQs
Utilities for Node APIs running on Azure
The npm package calvium-node-api-lib receives a total of 3 weekly downloads. As such, calvium-node-api-lib popularity was classified as not popular.
We found that calvium-node-api-lib demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 4 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
A malicious package uses a QR code as steganography in an innovative technique.
Research
/Security News
Socket identified 80 fake candidates targeting engineering roles, including suspected North Korean operators, exposing the new reality of hiring as a security function.
Application Security
/Research
/Security News
Socket detected multiple compromised CrowdStrike npm packages, continuing the "Shai-Hulud" supply chain attack that has now impacted nearly 500 packages.