Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
enrise-estools
Advanced tools
Elasticsearch tooling functions for managing indices and aliases. This can be used within an elasticsearch environment where a seperate index needs to be managed next to the live index. The script works by creating two aliases: a feeder-alias and a search-alias. Both are managed seperately. The former is used to fill an index and is set using the upgrade function. And the search-alias is set using the switch function.
This package is highly opiniated. Therefore it is use at your own risk.
npm install enrise-estools
const estools = require('enrise-estools');
upgrade
| Upgrade a feeder- aliasCreates a new versioned index according to the mapping, and points the feeder- alias to it.
estools.upgrade(esClient, index, options);
@param1: elasticsearch client
@param2: string | index to upgrade
@param2: options-object:
- index: string | index to use
- currentVersion: integer | existing version number, by default uses the $prefix $index version
- targetVersion: integer | new version number, by default uses the highest $index version + 1
- prefix: string, default:'feeder-' | prefix for feeder index
- mapping: object, default:current feeder-mapping | mapping to use for the new index
- synonyms: object={synonyms: [], preSynonyms: []} | synonyms to use for the new index, will overwrite the filters synonyms and pre_synonyms in the mapping with inline synonyms
- useExistingSynonyms: boolean | uses the existing feeder-synonyms for the new index
helpers.getAliasVersion
-> int | Retrieve the version of an aliasestools.helpers.getAliasVersion(esClient, alias);
@param1: elasticsearch client
@param2: string | alias
helpers.getIndexVersions
-> [int] | Retrieve all versions (descending) of an indexestools.helpers.getIndexVersions(esClient, index);
@param1: elasticsearch client
@param2: string | index
Ensure your working directory is clean. The following commands create a new version number by updating the package.json file and adding a git tag. Then push the new version with the tag to git, where GitLab CI will publish a new version. Version should only be updated by npm version, do not manually update the version in package.json.
npm version <newversion>
git push --follow-tags
./node_modules/.bin
.FAQs
Elasticsearch tooling functions for managing indices and aliases.
We found that enrise-estools demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.