Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
couchdb-ddoc-test
Advanced tools
This is a simple CouchDB design doc testing tool.
Usage:
var DDocTest = require('couchdb-ddoc-test');
var test = new DDocTest({
fixture: {a: 1},
src: 'path/to/map.js'
});
var result = test.runMap();
assert.equals(result, fixture);
require()
CouchDB supports require()
within design doc functions. It works slightly
different from require()
in e.g. Node.js (in which these tests are run).
Instead of relying on CouchDB’s require()
we will be using a couchapp
specific pre-processing directive. To make everything work, we have to
jump through a small hoop:
Say you want to var foo = require('foo');
within a map function. Do this:
function(doc) {
// prepare for require
var module = module || {};
// This next line is a `couchapp` preprocessor line, that copy and pastes the
// contents of `path/to/foo.js` into this function. It should define the
// variable `foo`. That is how this code is run within CouchDB. !code
// path/to/foo.js
// This next line makes sure that we only run the Node.js `require()` when the
// `!code` macro is not expanded. This is why !code path/to/foo.js should
// create the `foo` variable. If it doesn’t exist, we run a regular Node.js
// `require()`. With *one* caveat: since `map.js` will be run within `eval()`
// in another module than your tests, we need to put the full module path into
// `require()`, otherwise, the foo package would have to be a dependency of
// the couchdb-ddoc-test package, which wouldn’t work out. Anyhoo!
var foo = foo || require(process.cwd() + '/different/path/to/foo'
}
npm test
FAQs
CouchDB Design Doc Testing Tool
The npm package couchdb-ddoc-test receives a total of 93 weekly downloads. As such, couchdb-ddoc-test popularity was classified as not popular.
We found that couchdb-ddoc-test demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.