
Research
Namastex.ai npm Packages Hit with TeamPCP-Style CanisterWorm Malware
Malicious Namastex.ai npm packages appear to replicate TeamPCP-style Canister Worm tradecraft, including exfiltration and self-propagation.
cerebral-addons
Advanced tools

Additional utilities for use with cerebral/operators
import and from 'cerebral-addons/and';
import merge from 'cerebral-addons/merge';
cerebral-operators supports custom getter and setter functions in place of strings. If either of these functions is detected to by async (indicated by the returning of a promise) then the addon must be marked as async in the chain and subsequently define success and error paths.
A getter is a function that accepts the args passed to an action method and returns some value.
// getter should return a value or a promise which will later resolve to a value
[promise] getter(args)
an example getter might get some data from the server:
// define the getter
function httpGet(url) {
return function (args) {
return new Promise(resolve => {
getDataFromServer(url, function (err, data) {
resolve(data)
})
})
}
}
// use the getter
[
copy(httpGet('/api/date.json'), 'state:date'), {
success: [],
error: []
}
]
A setter is a function that accepts the args passed to an action method and the value to set.
// if the setter returns a promise then the addon will wait for it to resolve before continuing
[promise] setter(args, value)
if the setter is async then the addon will also pass on the resolve value to the success chain
an example setter might post some data to the server:
// define the setter
function httpPost(url) {
return function (args, value) {
return new Promise(resolve => {
postDataToServer(url, value, function (err, data) {
resolve(data) // response from server will be passed onto success chain
})
})
}
}
// use the setter
[
copy('state:date', httpPost('/api/date.json')), {
success: [],
error: []
}
]
cerebral-addons includes the following getters
export default [
when(and('state:firstCondition', 'input:otherCondition')), {
true: [],
false: []
}
]
Compose replaces all getters found in object given to the compose factory with the runtime values
Compose doesn't currently support async getters
export default [
copy(compose({
fromInput: get('input:value'),
fromState: get('state:value')
}), 'output:composed')
]
see compose
export default [
when(isEqual('state:firstValue', 'input:otherValue')), {
true: [],
false: []
}
]
export default [
when(isDeepEqual('state:firstValue', 'input:otherValue')), {
true: [],
false: []
}
]
export default [
copy(literal('literal'), 'output:value')
]
export default [
when(and('state:firstCondition', not('input:otherCondition'))), {
true: [],
false: []
}
]
export default [
when(or('state:firstCondition', 'input:otherCondition')), {
true: [],
false: []
}
]
copy(findWhere('state:users', { name: 'John' }), 'output:john')
pop also modifies the array in the state
copy(pop('state:users'), 'output:lastUser')
shift also modifies the array in the state
copy(shift('state:users'), 'output:firstUser')
cerebral-addons includes the following setters
copy('input:newData', merge('state:allData'))
copy('input:newUser', push('state:users'))
copy('input:newUser', unshift('state:users'))
Some adblockers such as uBlock Origin may block access to pop.js during development. This can
be resolved by turning off ad blocking for localhost or using webpack (or similar) for
development. This shouldn't be an issue for production deployments if you are packaging your
production dependencies in a combined .min.js.
Fork repo
npm installnpm start runs dev mode which watches for changes and auto lints, tests and buildsnpm test runs the testsnpm run lint lints the codenpm run build compiles es2015 to es5FAQs
An actions and factories utility belt for Cerebral
The npm package cerebral-addons receives a total of 62 weekly downloads. As such, cerebral-addons popularity was classified as not popular.
We found that cerebral-addons demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 4 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Malicious Namastex.ai npm packages appear to replicate TeamPCP-style Canister Worm tradecraft, including exfiltration and self-propagation.

Product
Explore exportable charts for vulnerabilities, dependencies, and usage with Reports, Socket’s new extensible reporting framework.

Product
Socket for Jira lets teams turn alerts into Jira tickets with manual creation, automated ticketing rules, and two-way sync.