
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
Cram data into your database easily for testing, demos, or whatever.
Install Cramit using npm and save it as a dependency in your package.json.
npm install cramit --save
You can require Cramit just like every other node.js module.
var cramit = require('cramit');
In order to define the data that will be added or removed from the database one or more fixtures must be created.
Note: The fixture file names must follow the configuration you set for Crave in Cramit's configuration object. By default, Crave looks for and requires any file that contains "_fixture" in the name.
// Filename: user_fixture.js
module.exports = function(cramit, options) {
function UserFixture() {
cramit.fixtureSuper(this, 'User');
}
UserFixture.prototype = cramit.fixturePrototype();
// Returns a new user not already in the database.
UserFixture.prototype.getNew = function() {
return {
"_id": "999999999999999999999999",
"activated": true,
"email": "kevin@gmail.com",
"name": "Kevin Mitnick"
};
};
// Returns a list of users to be added/removed from the database.
UserFixture.prototype.getAll = function() {
return [
{
"_id": "000000000000000000000000",
"activated": true,
"email": "charlie@gmail.com",
"name": "Charlie Kelly"
},
{
"_id": "000000000000000000000001",
"activated": false,
"email": "macsmom@gmail.com",
"name": "Mac's Mom"
}
];
};
return new UserFixture();
};
After the fixtures have been created you can call findAllFixturesAndUpsertData(). This will search for all fixture files and upsert the data returned from each fixture's getAll() method.
cramit.findAllFixturesAndUpsertData(applicationPath, {}, function(err, results) {
if(err) {
console.log(err);
} else {
console.log(results);
}
});
The Cramit API consists of the following methods.
Data you want to load into a database is defined in a fixture. A fixture is a pseudo "child class" that overrides a few methods called by the Cramit library. The data methods overridden in a fixture, such as getNew() and getAll(), return data objects to be loaded into the database. Let's look at an example of a user model and fixture.
// Filename: user_model.js
// Description: The user model defines the how the data is stored in the database.
module.exports = function() {
var db = require('mongoose');
var ObjectId = db.Schema.ObjectId;
var User = new db.Schema({
activated: { type: Boolean, default: true },
email: { type: String },
name: { type: String }
});
var UserSchema = db.model('User', User);
};
// Filename: user_fixture.js
// Description: Defines data and methods for adding or removing data to/from the database.
module.exports = function(cramit, options) {
function UserFixture() {
cramit.fixtureSuper(this, 'User');
}
UserFixture.prototype = cramit.fixturePrototype();
// Returns a new user not already in the database.
UserFixture.prototype.getNew = function() {
return {
"_id": "999999999999999999999999",
"activated": true,
"email": "kevin@gmail.com",
"name": "Kevin Mitnick"
};
};
// Returns a list of users to be added/removed from the database.
UserFixture.prototype.getAll = function() {
return [
{
"_id": "000000000000000000000000",
"activated": true,
"email": "charlie@gmail.com",
"name": "Charlie Kelly"
},
{
"_id": "000000000000000000000001",
"activated": false,
"email": "macsmom@gmail.com",
"name": "Mac's Mom"
}
];
};
return new UserFixture();
};
When implementing a fixture you may want to override one or more methods. The following is a list of possible methods.
The current implementation of these methods can be found here.
You can configure Cramit using the setConfig(myConfigObject) method. Pass along an object with any of the properties you wish to override. For example:
var cramit = require('cramit');
var mongoose = require(mongoose);
cramit.setConfig({
database: {
type: 'mongoose', // Set the type of database and connection.
instance: mongoose // Pass along the database connection object.
}
});
The available properties are:
| Property | Type | Default | Description |
|---|---|---|---|
| crave | Object | Accepts a Crave configuration object to define how models and fixtures are required. | |
| database | Object | An object containing configuration properties related to the database. | |
| database.connectionUri | String | undefined | The URI used to connect to a database. You may alternately choose to specify the database instance. |
| database.idAttributeName | String | undefined | The key used by all records as the unique identifier. For example mongoose uses _id. |
| database.instance | String | undefined | The database connection object. You may alternately choose to specify a connection URI instead. |
| database.type | String | undefined | Defines which database adapter to use. Available options are: mongoose. |
| debug | Boolean | false | When true, Cramit will display log messages. |
| error | Boolean | true | When true, Cramit will display error log messages. |
| trace | Boolean | false | When true, Cramit will display trace log messages. |
Debugging Cramit can be done using the debug, trace, and error flags that can be toggled on/off using the config. When enabling these flags additional logging will be enabled allowing you to find issues within Cramit easier.
Further documentation can be found in the wiki.
FAQs
Unknown package
We found that cramit demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.