
Research
Security News
Malicious PyPI Package Exploits Deezer API for Coordinated Music Piracy
Socket researchers uncovered a malicious PyPI package exploiting Deezer’s API to enable coordinated music piracy through API abuse and C2 server control.
distributed-locks-postgresql
Advanced tools
The postgresql package for the storage layer for distributed locks
We create a table for locks if it doesn't exist, table name is customizable
CREATE TABLE IF NOT EXISTS table } (
key varchar(50),
value varchar(100) NOT NULL,
ttl integer NOT NULL,
obtained_at timestamp DEFAULT current_timestamp,
CONSTRAINT pk_index PRIMARY KEY (key)
);
We start a transaction with isolation level repeatable read and it only has one SQL statement that inserts the row representing the lock
INSERT INTO table (key, value, ttl, obtained_at)
VALUES ('key', 'lock-value', 10, current_timestamp)
ON CONFLICT ON CONSTRAINT pk_index
DO
UPDATE SET value = 'lock-value', ttl = 10
WHERE locks.obtained_at + interval '1' second * locks.ttl < current_timestamp
returning *
Using the key that represents the critical section as primary key, we try to insert a record with it and the value represents our lock, if there is a conflict on the primary key constraint (someone else was able to acquire the lock) we can still update that row only if the previous lock expired (it's ttl + obtained at < current time stamp>).
If the upsert operation was successful we return a truthy value
Same as acquiring a lock we use a transaction with isolation level repeatable read. Simply delete the row with key equal to the critical section value, and the value equal to the lock value
DELETE FROM table
where key = 'key' AND value = 'lock-value';
FAQs
The postgresql package for the storage layer for distributed locks
The npm package distributed-locks-postgresql receives a total of 0 weekly downloads. As such, distributed-locks-postgresql popularity was classified as not popular.
We found that distributed-locks-postgresql demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket researchers uncovered a malicious PyPI package exploiting Deezer’s API to enable coordinated music piracy through API abuse and C2 server control.
Research
The Socket Research Team discovered a malicious npm package, '@ton-wallet/create', stealing cryptocurrency wallet keys from developers and users in the TON ecosystem.
Security News
Newly introduced telemetry in devenv 1.4 sparked a backlash over privacy concerns, leading to the removal of its AI-powered feature after strong community pushback.