Research
Security News
Kill Switch Hidden in npm Packages Typosquatting Chalk and Chokidar
Socket researchers found several malicious npm packages typosquatting Chalk and Chokidar, targeting Node.js developers with kill switches and data theft.
cluster-requiem
Advanced tools
Enhacements for the cluster
module in order to handle graceful shutdowns with jobs that aren't associated with a socket.
Node cluster
modules garantees that all server sockets will be closed before exiting the process, but this doesn't extends to all other jobs that can't be interrupted.
This makes the cluster
module useless when combined with softwares like PM2 as long standing jobs that don't have a client requets associated with it will die when you reload the server.
This module solves this by adding trackers
which holds the server up until all they finishes their jobs.
Install it
npm install --save cluster-requiem
Initialize and prepare servers
var http = require('http');
var cluster = require('cluster');
var requiem = require('cluster-requiem');
if (cluster.isMaster) {
var worker = cluster.fork();
setTimeout(function() {
console.log('disconnecting', worker.id);
worker.disconnect(function() {
console.log('done');
});
}, 2000);
} else {
var longJobThatCantBeInterrupted = function(callback) {
setTimeout(function() {
console.log('job done');
callback();
}, 10000);
};
requiem.initialize();
requiem.on('begin', function() {
console.log('grabs the violin')
});
var server = http.createServer(function(err, req) {
req.writeHead(200);
req.end('Hello world!');
});
requiem.track(function(callback) {
longJobThatCantBeInterrupted(callback);
});
server.listen(8080);
requiem.trackSocket(server);
console.log('listening')
}
Note: You need to track server sockets in case of a graceful shutdown(PM2 for instance, sends the 'shutdown' event before trying to kill the process). If you don't do this the server will stil receive connections while it waits for all trackers to finish. Under high load this will potentially lead the server to never close, making PM2 kill long standing jobs as it can't handle they.
FAQs
high availability enhacements for clustering
The npm package cluster-requiem receives a total of 2,939 weekly downloads. As such, cluster-requiem popularity was classified as popular.
We found that cluster-requiem demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket researchers found several malicious npm packages typosquatting Chalk and Chokidar, targeting Node.js developers with kill switches and data theft.
Security News
pnpm 10 blocks lifecycle scripts by default to improve security, addressing supply chain attack risks but sparking debate over compatibility and workflow changes.
Product
Socket now supports uv.lock files to ensure consistent, secure dependency resolution for Python projects and enhance supply chain security.