
Research
Malicious npm Packages Impersonate Flashbots SDKs, Targeting Ethereum Wallet Credentials
Four npm packages disguised as cryptographic tools steal developer credentials and send them to attacker-controlled Telegram infrastructure.
egg-mongoose-curd
Advanced tools
pkg -> plugin -> config -> extend -> agent.js -> app.js -> service -> middleware -> controller -> router
EggLoader.loadController() 默认参数为object,其中directory定义了默认只加载应用目录的app/controller。
加载时,初始化定义的controller类。 a. 如果是纯函数,则注入app参数,类似:func = func(app) b. 遍历每一个方法,包裹每一个方法,生成一个新的对象,类似: const ret = {}; ret[methodName] = wrapMethod(method); wrapMethod内部处理主要是改变this的指向,类似这样: wrapMethod = function(func){ const controller = new Controller(this); return function(...args){ return func.call(args,controller); } }
a. 定义了schema,希望扩展 schema 自动生成的 controller module.exports = (app)=>{ class Controller extend app.BaseController{ constructor(ctx) { super(ctx); this.name = 'user'; // 必须,对应的service名称 } } return Controller; } b. 扩展UserController module.exports = (app)=>{ class Controller extend app.UserController{ constructor(ctx) { super(ctx); this.name = 'user'; // 必须,对应的service名称 } } return Controller; }
a. 定义了schema,希望扩展 schema 自动生成的 controller module.exports = { async customMethod(){ // do something } }
根据密码、salt、secret、时间戳生成token,cookie 中存储id,token,time
清空cookie
根据 cookie 中的id,token,time,db 中的password,salt,配置的secret,校验token
db 中不存储 token,所以互相不影响
把password,salt,secret存储到redis即可
修改密码,后续考虑增加一个seed字段,重置该字段即可踢出所有已登陆账户
$ npm install
$ npm test
publish your framework to npm, then change app's dependencies:
// {app_root}/index.js
require('ocore').startCluster({
baseDir: __dirname,
// port: 7001, // default to 7001
});
Please open an issue here.
FAQs
Unknown package
The npm package egg-mongoose-curd receives a total of 1 weekly downloads. As such, egg-mongoose-curd popularity was classified as not popular.
We found that egg-mongoose-curd demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Four npm packages disguised as cryptographic tools steal developer credentials and send them to attacker-controlled Telegram infrastructure.
Security News
Ruby maintainers from Bundler and rbenv teams are building rv to bring Python uv's speed and unified tooling approach to Ruby development.
Security News
Following last week’s supply chain attack, Nx published findings on the GitHub Actions exploit and moved npm publishing to Trusted Publishers.