Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
This custom resource type allows you to write an event that will run when the resource's route receives a GET
or POST
request.
In your app's root directory, type npm install dpd-event
into the command line or download the source. This should create a dpd-event
directory in your app's node_modules
directory.
See Installing Modules for details.
The On POST
event will be executed when the resource's route (or a subroute) receives a POST
request, and likewise with the On GET
event.
It is strongly recommended that you reserve the On GET
event for operations that return a value, but don't have any side effects of modifying the database or performing some other operation.
If your resource is called /add-follower
, you can trigger its POST
event from dpd.js:
dpd.addfollower.post('320d6151a9aad8ce', {userId: '6d75e75d9bd9b8a6'}, function(result, error) {
// Do something
})
And over HTTP:
POST /add-follower/320d6151a9aad8ce
Content-Type: application/json
{
"userId": "6d75e75d9bd9b8a6"
}
In addition to the generic custom resource event API, the following functions and variables are available while scripting the Event resource:
Sets the response body. The result
argument can be a string or an object.
// On GET /top-score
dpd.scores.get({$limit: 1, $sort: {score: -1}}, (result) => {
setResult(result[0]);
});
Gets a request header. header
is case insensitive.
if (getHeader('x-api-key') != 'mysecretapikey') cancel(401, 'bad api key');
Set a response header.
setHeader('Content-Type', 'text/javascript');
setResult('typeof myCallback === "function" && myCallback("hello world")');
Sets the response http status code.
// temporary redirect to somewhere else
setStatusCode(302);
setHeader('Location', 'https://somesite/someotherplace');
The URL of the request, without the resource's base URL. If the resource is called /add-follower
and receives a request at /add-follower/320d6151a9aad8ce
, the url
value will be /320d6151a9aad8ce
.
// On GET /statistics
// Get the top score
if (url === '/top-score') {
dpd.scores.get({$limit: 1, $sort: {score: -1}}, function(result) {
setResult(result[0]);
});
}
An array of the parts of the url, separated by /
. If the resource is called /add-follower
and receives a request at /add-follower/320d6151a9aad8ce/6d75e75d9bd9b8a6
, the parts
value will be ['320d6151a9aad8ce', '6d75e75d9bd9b8a6']
.
// On POST /add-score
// Give the specified user (/add-score/:userId) 5 points
var userId = parts[0];
if (!userId) cancel("You must provide a user");
dpd.users.put({id: userId}, {score: {$inc: 5}}, function(result, err) {
if (err) cancel(err);
});
The query string object.
// On GET /sum
// Return the sum of the a and b properties (/sum?a=5&b=1)
setResult(Number(query.a) + Number(query.b));
The body of the request.
// On POST /sum
// Return the sum of the a and b properties {a: 5, b: 1}
setResult(Number(body.a) + Number(body.b));
FAQs
Deployd module to create custom events at a specified URL.
The npm package dpd-event receives a total of 8 weekly downloads. As such, dpd-event popularity was classified as not popular.
We found that dpd-event demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.