Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
A compression library for the modern web
Compactr is a library to compress and decompress Javascript objects before sending them over the web. It's immensely useful for web applications that use sockets a lot. Smaller payloads equals better, faster throughput and less bandwidth costs.
Yes, yes there are. Like msgpack, snappy and protocol-buffers.
Why yes, Protocol Buffer is by far the better performing protocol out there, but there's a few things about it I don't like - as a Node developer.
The first thing that comes to mind is the painful management of .proto
files.
Not only are they overly complex, they are also written in a different markup, which makes dynamic generation or property probing a bit of a hassle. Not to mention that you have to maintain parity across services of these messages that are more often than not a copy of your data Models. (See DRY)
Furthermore, Compactr has NO dependencies or compiled modules. It's the lightest module you've ever seen!
Protocol Buffers are awesome. Having schemas to deflate and inflate data while maintaining some kind of validation is a great concept. Compactr's goal is to build on that to better suit Node server development and reduce noise by allowing you to re-use your current Model schemas.
For example, if you have a DB schema for users, you can use that directly as a schema for Compactr.
| Waterline | Mongoose |
| --- | --- | --- |
| {
id: {
type: 'integer',
required: true
},
name: 'string'
}
| {
id: {
type: Number,
required: true
},
name: String
}
|
/* User compessing in a controller */
const Compactr = require('compactr');
User.create({ id: 0, name: 'Bruce' })
.then(user => Compactr.encode(User, user))
.then(deflated => /* Send encoded User */);
/* Decoding the User data */
let user = Compactr.decode(User, deflated);
No need to create additional models for serialization!
Oh yes, via webpack!
npm run build
Will generate browser-ready code!
You need Node 6.0.0 and up
TODO
I'm still working on graphs and proper test scenarios, but I can say that it performs as fast, and sometimes faster than JSON encoding/decoding and outputs a buffer that is more or less half the size!
In the near future, you will be able to:
Just open an issue, identifying it as a feature that you want to tackle.
Ex: STORY - [...]
And we'll take the discussion there.
FAQs
Schema based serialization made easy
The npm package compactr receives a total of 0 weekly downloads. As such, compactr popularity was classified as not popular.
We found that compactr demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.