
Research
SANDWORM_MODE: Shai-Hulud-Style npm Worm Hijacks CI Workflows and Poisons AI Toolchains
An emerging npm supply chain attack that infects repos, steals CI secrets, and targets developer AI toolchains for further compromise.
OSS plugin for egg
$ npm i egg-oss
To enable oss plugin, you should change ${baseDir}/config/plugin.js
// config/plugin.js
exports.oss = {
enable: true,
package: 'egg-oss',
};
Then fill in nessary information like OSS's bucket, accessKeyId, accessKeySecret in ${baseDir}/config/config.{env}.js
Mention, egg-oss support normal oss client and oss cluster client, based on ali-oss:
// normal oss bucket
exports.oss = {
client: {
accessKeyId: 'your access key',
accessKeySecret: 'your access secret',
bucket: 'your bucket name',
endpoint: 'oss-cn-hongkong.aliyun.com',
timeout: '60s',
},
};
// cluster oss bucket
// need to config all bucket information under cluster
exports.oss = {
client: {
cluster: [{
endpoint: 'host1',
accessKeyId: 'id1',
accessKeySecret: 'secret1',
}, {
endpoint: 'host2',
accessKeyId: 'id2',
accessKeySecret: 'secret2',
}],
schedule: 'masterSlave', //default is `roundRobin`
timeout: '60s',
},
};
// if config.sts == true, oss will create STS client
exports.oss = {
client: {
sts: true,
accessKeyId: 'your access key',
accessKeySecret: 'your access secret',
},
};
Init in egg agent, default is false:
exports.oss = {
useAgent: true,
};
You can aquire oss instance on app or ctx.
const path = require('path');
// upload a file in controller
module.exports = function*() {
const parts = this.multipart();
let object;
let part;
part = yield parts;
while (part) {
if (part.length) {
// arrays are busboy fields
console.log('field: ' + part[0]);
console.log('value: ' + part[1]);
console.log('valueTruncated: ' + part[2]);
console.log('fieldnameTruncated: ' + part[3]);
} else {
// otherwise, it's a stream
console.log('field: ' + part.fieldname);
console.log('filename: ' + part.filename);
console.log('encoding: ' + part.encoding);
console.log('mime: ' + part.mime);
// file handle
object = yield this.oss.put('egg-oss-demo-' + part.filename, part);
}
part = yield parts;
}
console.log('and we are done parsing the form!');
if (object) {
console.log('get oss object: %j', object);
this.unsafeRedirect(object.url);
} else {
this.body = 'please select a file to upload!';
}
}
To learn OSS client API, please check oss document。
Some application need to access more than one oss bucket, then you need to configure oss.clients, and
you can create new oss instance dynamicly by app.oss.createInstance(config).
${appdir}/config/config.default.jsexports.oss = {
clients: {
bucket1: {
bucket: 'bucket1',
},
bucket2: {
bucket: 'bucket2',
},
},
// shared by client, clients and createInstance
default: {
endpoint: '',
accessKeyId: '',
accessKeySecret: '',
},
};
exports.bucket3 = {
bucket: 'bucket3',
};
${appdir}/config/plugin.jsexports.oss = true;
${appdir}/app.jsmodule.exports = function (app) {
const bucket1 = app.oss.get('bucket1');
const bucket2 = app.oss.get('bucket2');
// it will merge app.config.bucket3 and app.config.oss.default
const bucket3 = app.oss.createInstance(app.config.bucket3);
}
Please open an issue here.
ping @fengmk2 to give you the access key!
FAQs
OSS plugin for egg
We found that egg-oss demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 3 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
An emerging npm supply chain attack that infects repos, steals CI secrets, and targets developer AI toolchains for further compromise.

Company News
Socket is proud to join the OpenJS Foundation as a Silver Member, deepening our commitment to the long-term health and security of the JavaScript ecosystem.

Security News
npm now links to Socket's security analysis on every package page. Here's what you'll find when you click through.