
Security News
/Research
Wallet-Draining npm Package Impersonates Nodemailer to Hijack Crypto Transactions
Malicious npm package impersonates Nodemailer and drains wallets by hijacking crypto transactions across multiple blockchains.
Evented.IO is a Node.JS module that provides a structured way of building RESTful API servers in combination with Websockets (Using Socket.IO) writen in CoffeScript.
The reason why I've created Evented.IO is because I like another framework called MeteorJS, but meteor is a full-stack framework. I needed the flexibility of an express.js server with the ease of use of a MeteorJS Server.
Also, Evented.IO provides a client-server JavaScript API to work with collections in realtime, in Meteor flavor. The API will result familiar to you even if you have used Firebase.
I wanted to construct AngularJS applications and mobile native applications using those kind of API's and being compleit enough to make whatever you want, having all control over your server.
I've used deployd for example, but I don't like the idea of for example, can't login by default using an OAuth provider. You have to figure out how to implement it. Evented.IO is compatible with everything, so you can implement it your way maybe using.... ¿Passport?
That said, let's provide a little of light over the table.
In order to instantiate a new server you need to have running an instance of MongoDB and another of a Redis store
evented = require 'evented.io'
Evented = evented({port: 5000});
You should have 2 folders on your server's root directory:
Checkout the examples to know how to write new models and controllers to create RESTful routes
This is not the real User model implementation, we need password salting and those things, but this will give you an idea. Default Modules are loaded into process.modules
This is the default schema for a model.
# Model Structure
mongoose = process.modules.mongoose
validate = process.modules.validate
animalSchema = mongoose.Schema
name:
type: String
required: true
unique: true
validate: validate('len', 5, 10)
kind:
type: String
required: true
enum: ['cat', 'dog']
# Animal model
module.exports = mongoose.model('Animal', animalSchema);
# Animals controller
Animal = process.server.mongodb.models.Animal
getAllAnimals =
method: 'get'
path: "/animal"
version: 1 # Here we specify the version http://api.server.com/v1/animals
description: 'Get all Animals'
docURL: '/AnimalController#GET_ALL_ANIMAL_ACTION' # Documentation URL
params:
# you can specify required or optional fields
required: []
optional: []
# Also allowed user kinds and roles
allowedUserKinds: []
roles: []
callback: (req, res, completeCall) ->
Animal
.find()
.exec (err, animals)->
if err
return next
# Send this data structure
httpStatus: 500 # There was an error
metadata: err
completeCall({animals: animals})
module.exports = ->
# Here is where we export our Restfull API's
[getAllAnimals]
To use custom databases into your server do the next thing:
Your node index.js
Evented = evented({
port: 5000,
mongo: {
host: 'localhost'
password: '27017'
db: 'testdb'
user: ''
password: ''
},
redis: {
host: 'localhost'
port: '6379'
password: ''
}
});
You should use this two scripts in your header
<head>
<script src="socket.io/socket.io.js"></script>
<script src="evented.js"></script>
</head>
FAQs
Evented.io is a realtime API server.
The npm package evented.io receives a total of 0 weekly downloads. As such, evented.io popularity was classified as not popular.
We found that evented.io demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
/Research
Malicious npm package impersonates Nodemailer and drains wallets by hijacking crypto transactions across multiple blockchains.
Security News
This episode explores the hard problem of reachability analysis, from static analysis limits to handling dynamic languages and massive dependency trees.
Security News
/Research
Malicious Nx npm versions stole secrets and wallet info using AI CLI tools; Socket’s AI scanner detected the supply chain attack and flagged the malware.