
Research
PyPI Package Disguised as Instagram Growth Tool Harvests User Credentials
A deceptive PyPI package posing as an Instagram growth tool collects user credentials and sends them to third-party bot services.
Dependency Injection framework for Node.js (and JavaScript in general)
The very basics are shown here. First, an instance of the injector is created. Then the creation of a shape-module depending on the constants-module. Then the creation of a constants-module, without dependencies. Finally an anonymous module depending on the shapes-module.
var dinode = require('dinode');
var di = dinode.construct();
di.registerModule('shapes', ['constants'], function(deps) {
var constants = deps.constants;
return {
sphereVolume: function(radius) {
return 4 * constants.PI * radius / 3;
}
};
});
di.registerModule('constants', [], function() {
return {
PI: 3.1415
};
});
di.registerModule(null, ['shapes'], function(deps) {
var shapes = deps.shapes;
var vol = shapes.sphereVolume(4000);
console.log("The volume of the earth is " + vol + " liters");
});
By default, anonymous modules are the only ones that triggers execution. They can't be depended on, so they must do something with side-effects to be of interest. Named modules on the other hand are only loaded if they're needed to run an anonymous module.
Here the connection to the database is registered as a module. It helps prevent callback-hell by letting modules that needs the open connection depend on that connection. The dependants does not need to know whether their dependencies are sync or async; they will simply wait for the result to become available.
This makes for very easy refactoring when going from sync to async implementations. It also gives very clean and sync-looking modules, even when there are many async things being depended on the background.
var dinode = require('dinode');
var someDatabase = require('some-db');
var di = dinode.construct();
di.registerModule('dbConnection', [], function(deps, callback) {
someDatabase.open('foo.bar@localhost/myDb', function(err, db) {
callback(err, db);
});
});
di.registerModule(null, ['dbConnection'], function(deps) {
var db = deps.dbConnection;
db.query('SELECT * FROM something", function(err, result) {
console.log(err, result);
})
});
To be written...
Sometimes it can be hard to figure out what the dependency tree looks like or why it is not resolving like it should. Luckily there's a method for peeking at the internal state of dinode; introspect
To be written...
FAQs
Dependency Injection framework for Node.js (and JavaScript in general)
The npm package dinode receives a total of 1 weekly downloads. As such, dinode popularity was classified as not popular.
We found that dinode demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
A deceptive PyPI package posing as an Instagram growth tool collects user credentials and sends them to third-party bot services.
Product
Socket now supports pylock.toml, enabling secure, reproducible Python builds with advanced scanning and full alignment with PEP 751's new standard.
Security News
Research
Socket uncovered two npm packages that register hidden HTTP endpoints to delete all files on command.