
Research
Malicious npm Packages Impersonate Flashbots SDKs, Targeting Ethereum Wallet Credentials
Four npm packages disguised as cryptographic tools steal developer credentials and send them to attacker-controlled Telegram infrastructure.
Basic Hapi server with some baked in features that can be pulled in as a dependency of another application to extend as needed.
Features include:
$ npm install
Look at the /example/app.js to see an example of how this can be pulled in as a dependency. You can see it running by doing the following.
$ PORT=5000 node example/app.js
info Server running at http://0.0.0.0:5000
info Server name: testHarness
info Server version: 0.1.0
info Server maxListeners: 1000
info Server environment: development
info Server in debug mode: true
160915/014027.438, [ops] memory: 65Mb, uptime (seconds): 5.705, load: [1.30322265625,1.486328125,1.5888671875]
160915/014032.438, [ops] memory: 58Mb, uptime (seconds): 10.706, load: [1.35888671875,1.49462890625,1.5908203125]
You can also navigate to localhost:5000 and see a served page.
Swagger documentation - localhost:5000/documentation
Healthcheck monitoring - localhost:5000/__health
$ cd <cnn-hapi-root>
$ npm run example-server
This will run the example server in the ./example
directory.
LOADER_IO_VALIDATION
PORT
LOCAL_TLS_PORT
CACHE_CONTROL
ENVIRONMENT
HOST
DEFAULT_MAX_LISTENERS
SURROGATE_CACHE_CONTROL
SHOW_CNN_HAPI_CONFIG
=> Setting this to 'true' will show server instance configurations on server.start()
. Requires DEBUG=cnn-hapi*
to be a part of DEBUG
capture group
METRICS_FLUSHEVERY
The following options set defaults at the server level and can override CNN-Hapi Defaults
Populate notes are in order of priority. Example: populate: process.env.SOMEVALUE
|| options.someValue
. In that example if process.env.SOMEVALUE
is not set it will default to options.someValue
, etc, etc
Manual override possibilites are expressed in options.someValue
options
is an object that can take the following keys
basePath
: project basePath,
cacheControlHeader
: process.env.CACHE_CONTROL || 'max-age=60',
customHeaders
: options.customHeaders || [],
description
: options.description || package.json
description
key,
environment
: process.env.ENVIRONMENT || process.env.NODE_ENV || options.environment || '',
healthChecks
: options.healthChecks || [],
host
: process.env.HOST || options.host || '0.0.0.0',
loaderIoValidationKey
: options.loaderIoValidationKey || undefined,
localTLS
: options.localTLS || null,
maxListeners
: process.env.DEFAULT_MAX_LISTENERS || options.maxListeners || 10,
name
: options.name || package.json
name
key,
port
: process.env.PORT || options.port || 3000,
surrogateCacheControl
:
process.env.SURROGATE_CACHE_CONTROL || options.surrogateCacheControl || 'max-age=360, stale-while-revalidate=60, stale-if-error=86400',
version
:options.version || package.json
version
key,
withGoodConsole
: options.withGoodConsole || false,
withSwagger
: options.withSwagger || false
Using the reply.header() function can set headers on a singular route
{
method: 'GET',
path: '/override-headers',
handler: (request, reply) => {
reply('Peep the response headers in swagger docs')
.header('Cache-Control', '2')
.header('Surrogate-Control', 'baz');
},
config: {
description: 'Example route for demonstrating how to override headers by route',
tags: ['api']
}
},
For explicit usage check this implementation in ./example/routes
$ npm run example-server
It runs example server located in ./example
. Pass in ENV vars through the above command or hardcode into the package.json located in the ./example
directory.
Go to {HOST}:{PORT}/documentation to view the new swagger docs and to test current CNN-Hapi
logic.
FAQs
This is a generic Hapi server for starting projects.
The npm package cnn-hapi receives a total of 6 weekly downloads. As such, cnn-hapi popularity was classified as not popular.
We found that cnn-hapi demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 9 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Four npm packages disguised as cryptographic tools steal developer credentials and send them to attacker-controlled Telegram infrastructure.
Security News
Ruby maintainers from Bundler and rbenv teams are building rv to bring Python uv's speed and unified tooling approach to Ruby development.
Security News
Following last week’s supply chain attack, Nx published findings on the GitHub Actions exploit and moved npm publishing to Trusted Publishers.