Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
A compression library for the modern web
Compactr is a library to compress and decompress Javascript objects before sending them over the web. It's immencely usefull for web applications that use sockets a lot. Smaller payloads equals better, faster throughput and less bandwidth costs.
Yes, yes there are. Like msgpack, snappy and protocol-buffers.
Why yes, Protocol Buffer is by far the better performing protocol out there, but there's a few things about it I don't like - as a Node developper.
The first thing that comes to mind is the painful management of .proto
files.
Not only are they overly complex, they are also written in a different markup, which makes dynamic generation or property probing a bit of a hassle. Not to mention that you have to maintain parity across services of these messages that are more often than not a copy of your data Models. (See DRY)
Protocol Buffers are awesome. Having schemas to deflate and inflate data while maintaining some kind of validation is a great concept. Compactr's goal is to build on that to better suite Node server developement and reduce noise by allowing you to re-use your current Model schemas.
For example, if you have a DB schema for users, you can use that directly as a schema for Compactr.
/* Waterline Schema (User) */
{
id: {
type: 'integer',
required: true
},
name: {
type: 'string',
defaultsTo: 'John'
}
}
/* User compessing in controller */
const Compactr = require('compactr');
User.create({ id: 0, name: 'Bruce' })
.then(user => Compactr.encode(User, user))
.then(deflated => /* Send encoded User */);
/* Decoding the User data */
let user = Compactr.decode(User, deflated);
Oh yes, via webpack!
npm run build
Will generate browser-ready code!
You need Node 6.0.0 and up
See this chart:
In the near future, you will be able to:
Just open an issue, identifying it as a feature that you want to tackle.
Ex: STORY - [...]
And we'll take the discussion there.
FAQs
Schema based serialization made easy
The npm package compactr receives a total of 0 weekly downloads. As such, compactr popularity was classified as not popular.
We found that compactr demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.