Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Cot is a rather simple but quite pleasant interface for CouchDB. It doesn't attempt to implement everything, but it covers the important stuff for using couch as an effective database.
var Cot = require('cot');
var cot = new Cot({port: 5984, hostname: 'localhost'});
var db = cot.db('my-db');
db.getDoc('counter', onGet);
function onGet(err, doc) {
if (err) throw err;
if (doc === null) {
doc = {
_id: 'counter',
count: 0
};
}
doc.count += 1;
db.putDoc(doc, {conflictOk: true}, onPut);
}
function onPut(err, response) {
if (err) throw err;
if (response.conflict) {
db.getDoc('counter', onGet);
}
else {
console.log('done!');
}
}
There's actually a utility function for an optimistic update loop:
db.updateDoc('counter', mutate, onUpdate);
function mutate(doc, next) {
doc.count = (doc.count || 0) + 1;
next();
}
function onUpdate(err) {
if (err) throw err;
console.log('done!');
}
opts
must contain the following keys:
port
: the port number of your couchdb serverhostname
: the hostname of your couchdb serveropts
may contain the following keys:
ssl
: if set to true, Cot will use httpsauth
: may be set to a string in the format 'username:password' for basic authReturns an object representing the specified database.
Queries database info and calls next when done.
Gets a doc out of the database. If the doc is missing, err will be null and doc will be null.
Gets a doc out of the database and passes it to condition. If condition returns false, next will be called with doc === null as if the doc did not exist. This is useful for avoiding the easy mistake of writing code that allows access to your entire database:
db.getDocWhere(query.docId, function(doc) { return doc.isPublic }, onGet);
Attempts to put doc into database. The doc must have an _id
field. If you expect to handle update conflicts, send {conflictOk: true} in opts. Otherwise, conflicts will be treated as errors. In any case, the response from couch is passed to next so you can retrieve the new rev or detect a conflict if conflictOk: true
. Response may be something like:
{ok: true, rev: '2-whatever'}
Or, in case of a conflict where conflictOk: true
:
{error: 'conflict'}
Reads doc from the database and calls fn(doc, cb)
. fn
may directly mutate doc and call cb
when done. Then updateDoc will attempt to put the modified document back in the database. If there is an update conflict, the process will start over and repeat until success.
Attempts to delete the document with the specified docId and rev. As with putDoc, you may pass {conflictOk: true}
in opts.
Queries a view with the given name in the given design doc. query
should be an object with any of the following keys:
For more information, refer to http://wiki.apache.org/couchdb/HTTP_view_API#Querying_Options
Queries the _all_docs view. query
supports the same keys as in db.view
.
Queries the specified keys from the specified view. Keys should be an array of keys.
Loads documents with the specified keys.
Posts multiple updates to the database in one request. docs
should be an array of documents. allOrNothing
should be a boolean. See http://wiki.apache.org/couchdb/HTTP_Bulk_Document_API for more information.
Queries the changes feed given the specified query. query
may contain the following keys:
filter
: filter function to useinclude_docs
: if true, results will contain entire documentlimit
: the maximum number of change rows this query should returnsince
: results will start immediately after the sequence number provided herelongpoll
: if true, query will send feed=longpolltimeout
: timeout in milliseconds for logpoll queriesFor more information about the CouchDB changes feed, see http://wiki.apache.org/couchdb/HTTP_database_API#Changes
FAQs
promise-based CouchDB library with no surprises (in a good way)
The npm package cot receives a total of 1 weekly downloads. As such, cot popularity was classified as not popular.
We found that cot demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.