
Research
Security News
Lazarus Strikes npm Again with New Wave of Malicious Packages
The Socket Research Team has discovered six new malicious npm packages linked to North Korea’s Lazarus Group, designed to steal credentials and deploy backdoors.
cluster-service
Advanced tools
Turns your single process code into a fault-resilient multi-process service with built-in REST & CLI support
git clone https://github.secureserver.net/PC/node-dps.git
npm install
The short answer:
Turns your single process code into a fault-resilient multi-process service with built-in REST & CLI support.
The long answer:
Adds the ability to execute worker processes over N cores for extra service resilience, includes worker process monitoring and restart on failure, continuous integration, as well as HTTP & command-line interfaces for health checks, cluster commands, and custom service commands.
At the core of DPS Cluster is parent/child process relationship, which is built atop Node's cluster module, allowing all application code to be executed within child processes, even if resource sharing (i.e. tcp/http binding on the same ports).
// server.js
var cservice = require("cluster-service");
cservice.start("./worker", { workerCount: os.cpus().length, accessKey: "lksjdf982734", onWorkerStop: function() { /* optional cleanup of my worker */ } });
// worker.js
var cservice = require("cluster-service");
cservice.workerReady({
onWorkerStop: function() { /* perform some optional cleanup if you want to control the exit of worker process */ }
});
A DPS Cluster Service has two interfaces, the console (stdio), and an HTTP REST API. The two interfaces are treated identical, as console input/output is piped over the REST API. The reason for the piping is that a DPS Cluster Service is intentionally designed to only support one version of the given service running at any one time, and the port binding is the resource constraint. This allows secondary services to act as console-only interfaces as they pipe all input/output over HTTP to the already running service that owns the port. This flow enables the CLI to background processes. The REST API is locked to a "accessKey" expected in the query string. The console automatically passes this key to the REST API, but for external REST API access, the key will need to be known.
{ cluster: { host: "localhost", port: 11987, accessKey: "lksjdf982734" } }
By default, a worker (child) process that exits unexpectedly will be restarted. This can be configured to prevent processes from dieing too frequently, in the case the desired outcome is to fail completely if there is something seriously wrong with the workers.
{ cluster: { autoRestart: true, restartDelayMs: 100, restartsPerMinute: 10 } }
Combining the Worker Process (Cluster) model with a CLI piped REST API enables the ability command the already-running service to replace existing workers with workers in a different location. This capability is still a work in progress, but initial tests are promising.
While a Cluster Service may provide its own custom commands, below are provided out-of-the-box. Commands may be disabled by overriding them.
Events are emitted to interested parties.
Creating custom, or overriding commands and events is as simple as:
var cservice = require("cluster-service");
cservice.on("custom", function(evt, cb, arg1, arg2) { // "custom" command
// can also fire custom events
dpscluster.trigger("on.custom.complete", 1, 2, 3);
};
cservice.on("test", function(evt, cb, testScript, timeout) { // we're overriding the "test" command
// arguments
// do something, no callback required (events may optionally be triggered)
};
// can also issue commands programatically
cservice.trigger("custom", function(err) { /* my callback */ }, "arg1value", "arg2value");
FAQs
Turns your single process code into a fault-resilient multi-process service with built-in REST & CLI support
The npm package cluster-service receives a total of 748 weekly downloads. As such, cluster-service popularity was classified as not popular.
We found that cluster-service demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
The Socket Research Team has discovered six new malicious npm packages linked to North Korea’s Lazarus Group, designed to steal credentials and deploy backdoors.
Security News
Socket CEO Feross Aboukhadijeh discusses the open web, open source security, and how Socket tackles software supply chain attacks on The Pair Program podcast.
Security News
Opengrep continues building momentum with the alpha release of its Playground tool, demonstrating the project's rapid evolution just two months after its initial launch.