
Security News
/Research
Wallet-Draining npm Package Impersonates Nodemailer to Hijack Crypto Transactions
Malicious npm package impersonates Nodemailer and drains wallets by hijacking crypto transactions across multiple blockchains.
dyconf can be used to generate a dynamically updated configuration from a template. It can also launch processes whenever a change is detected.
dyconf is a tool, not a library. It is best suited to run inside a docker container.
TL;DR you can find a working sample in consul-haproxy-dyconf.
npm install dyconf -g
usage: dyconf -config=FILE [OPTIONS]
-config path to the template configuration
-dump dumps the generated template to the console
-q quiet, no logs
When you launch dyconf you need to specify -config=FILE
, all other parameters are passed to the controller.
The Hjson configuration defines the following settings:
true
to run a syslog server and print to the console (useful with the docker logs command)The controller can define additional settings.
dyconf uses lodash.template.
The controller is a JavaScript module that is executed by dyconf.
All controller functions are passed a context that contains:
The module needs to export:
function init(ctx, showHelp)
init can be used to
Return true to continue, false to exit.
function fetchData(ctx)
Use fetchData to collect data required for the template.
Return a promise with the data that will be passed to the template.
function start(ctx, update)
Starts the update process. If start is not supplied a fixed interval (refreshInterval
) will be used.
You can use start
to watch for changes. Call update
to trigger fetchData
and to create/refresh the output file.
The Hello World source is available in the sample folder.
#hjson (go to http://hjson.org for details)
{
# define the controller that fetches the configuration and produces the content for outputFile
controller: controller.js
outputFile: /tmp/test.txt
# refresh interval in seconds
refreshInterval: 5
# start a syslog server listening on port 514 (use rfc5424)
# can be used to redirect logs for Docker
syslog: false
# logfile to tail to the console (can be "")
# can be used like syslog for Docker
logFile: ""
# run on start/restart
startup:
'''
# prepare, configure files or run any required processes
# here you would launch the main process (e.g. haproxy)
# for the sample we only show the outputFile
cat /tmp/test.txt
'''
# reload a new configuration
reload:
'''
# here you would tell the main process (e.g. haproxy)
# to reload it's configuration
# for the sample we only show the outputFile
echo ---
cat /tmp/test.txt
'''
# run on shutdown
shutdown:
'''
# here you would kill the main process
'''
# define the template to generate the outputFile
/*
`random` was generated by the code in controller.js
*/
template:
'''
<% [ "World", "Human" ].forEach(name => {
%>Hello <%=name%>!
<% }); %>
In a real world scenario this file would contain the configuration generated by dyconf.
Today's random value is <%=random%>!
'''
}
// if you `require` any libraries you can add them to package.json &
// run `npm i` in the directory that contains this file.
var max;
// init runs at startup to configure options and initialize prerequisites
function init(ctx, showHelp) {
var args=ctx.args;
if (showHelp || ctx.argv.length>0) {
console.error("usage: -max=#");
console.error();
console.error(" -max max random sample value");
console.error(ctx.helpText);
return false;
}
max=parseInt(args.max||"999");
return true;
}
// fetchData can be used to query an external service (like consul)
// it needs to return a data structure that will be used to generate the template
function fetchData(ctx) {
return new Promise((resolve, reject) => resolve(Math.random()*max))
.then(x => ({ random: x }));
}
// start the update process (optional)
// can be used to implement a watch on a service
function start(ctx, update) {
setInterval(update, 1000);
update();
}
module.exports={
init: init,
fetchData: fetchData,
start: start,
};
FAQs
Dynamic configuration template rendering.
The npm package dyconf receives a total of 0 weekly downloads. As such, dyconf popularity was classified as not popular.
We found that dyconf demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
/Research
Malicious npm package impersonates Nodemailer and drains wallets by hijacking crypto transactions across multiple blockchains.
Security News
This episode explores the hard problem of reachability analysis, from static analysis limits to handling dynamic languages and massive dependency trees.
Security News
/Research
Malicious Nx npm versions stole secrets and wallet info using AI CLI tools; Socket’s AI scanner detected the supply chain attack and flagged the malware.