
Research
SANDWORM_MODE: Shai-Hulud-Style npm Worm Hijacks CI Workflows and Poisons AI Toolchains
An emerging npm supply chain attack that infects repos, steals CI secrets, and targets developer AI toolchains for further compromise.
OSS plugin for egg
$ npm i egg-oss
To enable oss plugin, you should change ${baseDir}/config/plugin.js
// config/plugin.js
exports.oss = {
enable: true,
package: 'egg-oss',
};
Then fill in nessary information like OSS's bucket, accessKeyId, accessKeySecret in ${baseDir}/config/config.{env}.js
Mention, egg-oss support normal oss client and oss cluster client, based on ali-oss:
// normal oss bucket
exports.oss = {
client: {
accessKeyId: 'your access key',
accessKeySecret: 'your access secret',
bucket: 'your bucket name',
endpoint: 'oss-cn-hongkong.aliyun.com',
timeout: '60s',
},
};
// cluster oss bucket
// need to config all bucket information under cluster
exports.oss = {
client: {
cluster: [{
endpoint: 'host1',
accessKeyId: 'id1',
accessKeySecret: 'secret1',
}, {
endpoint: 'host2',
accessKeyId: 'id2',
accessKeySecret: 'secret2',
}],
schedule: 'masterSlave', //default is `roundRobin`
timeout: '60s',
},
};
// if config.sts == true, oss will create STS client
exports.oss = {
client: {
sts: true,
accessKeyId: 'your access key',
accessKeySecret: 'your access secret',
},
};
Init in egg agent, default is false:
exports.oss = {
useAgent: true,
};
You can aquire oss instance on app or ctx.
The example below will upload file to oss using the file mode of egg-multipart.
const path = require('path');
const Controller = require('egg').Controller;
const fs = require('mz/fs');
// upload a file in controller
module.exports = class extends Controller {
async upload() {
const ctx = this.ctx;
const file = ctx.request.files[0];
const name = 'egg-oss-demo/' + path.basename(file.filename);
let result;
try {
result = await ctx.oss.put(name, file.filepath);
} finally {
await fs.unlink(file.filepath);
}
if (result) {
console.log('get oss object: %j', object);
ctx.unsafeRedirect(result.url);
} else {
ctx.body = 'please select a file to upload!';
}
}
};
To learn OSS client API, please check oss document。
Some application need to access more than one oss bucket, then you need to configure oss.clients, and
you can create new oss instance dynamicly by app.oss.createInstance(config).
${appdir}/config/config.default.jsexports.oss = {
clients: {
bucket1: {
bucket: 'bucket1',
},
bucket2: {
bucket: 'bucket2',
},
},
// shared by client, clients and createInstance
default: {
endpoint: '',
accessKeyId: '',
accessKeySecret: '',
},
};
exports.bucket3 = {
bucket: 'bucket3',
};
${appdir}/config/plugin.jsexports.oss = true;
${appdir}/app.jsmodule.exports = function (app) {
const bucket1 = app.oss.get('bucket1');
const bucket2 = app.oss.get('bucket2');
// it will merge app.config.bucket3 and app.config.oss.default
const bucket3 = app.oss.createInstance(app.config.bucket3);
}
Please open an issue here.
ping @fengmk2 to give you the access key!
FAQs
OSS plugin for egg
The npm package egg-oss receives a total of 386 weekly downloads. As such, egg-oss popularity was classified as not popular.
We found that egg-oss demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 3 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
An emerging npm supply chain attack that infects repos, steals CI secrets, and targets developer AI toolchains for further compromise.

Company News
Socket is proud to join the OpenJS Foundation as a Silver Member, deepening our commitment to the long-term health and security of the JavaScript ecosystem.

Security News
npm now links to Socket's security analysis on every package page. Here's what you'll find when you click through.