
Research
Malicious npm Packages Impersonate Flashbots SDKs, Targeting Ethereum Wallet Credentials
Four npm packages disguised as cryptographic tools steal developer credentials and send them to attacker-controlled Telegram infrastructure.
express-gui
Advanced tools
ExpressJS basic file delivery with a small layer of templating provided by lodash
ExpressJS basic file delivery with a small layer of templating provided by lodash.
| Should be paired with connect-modrewrite and conf-stack, more information below
npm install express-gui
On your main app file (server.js)
'use strict';
// Get a logger
var logger = console;
// Log some info
logger.log('Starting server process: '+process.pid);
var
// Load some apis
guiApi = require('express-gui')
// Get some references
,express = require('express')
,confStack = require('conf-stack')
,modrewrite = require('connect-modrewrite')
// Create some instances
,app = express()
// Load the configuration
,config = confStack()
;
// Add the logger to the app and a reference of it to the request
app.logger = logger;
app.use(function(req, res, next){
req.logger = logger;
next();
});
// Allow internal URL aliasing
logger.info('Config modrewrite is set to: ', config.modrewrite);
app.use(modrewrite(config.modrewrite||[]));
// Load dependency APIs
logger.log('Configuring GUI...');
guiApi(app, config);
// If not handled by now, provide the default url
app.use(function(req,res,next){
res.send('Nothing here. Maybe will redirect to config.public.home');
});
// Start listening
app.listen(config.port);
logger.info('Server running at: ', config.port);
// Handle Errors sample
app.use(function handleError(err, req, res, next){
logger.error(err);
if(err.code === 'ENOENT'){ err.message = 'File not found'; }
res.status(err.status).json({
msg : err.message
,id : err.id
,status : err.status
});
next();
});
// Require the debugger and run node-inspector
// var inspector = require('delay-debug');
// inspector();
Using conf-stack, create a conf directory and add the following to base.yaml, note that you will need to change /gui for whichever path the gui middleware is located at. Also pick a base path for your api, like /api and put all routes there
base.yaml
modrewrite:
# Sample redirection, your api should be at api/base or so
- "/some/url/from/api /api/redirect/here/as/last [L]"
# Redirection for frontend
- "^/sample(.+)?$ /gui/?file=app.html&appName=sample-app [L]" # To reuse an html for multilpe websdk builds
- "^/$ /gui?file=app.html&appName=sample-app [L]" # Will serve app.html on root
- "^/(?!gui(\\/)?)(.+\\..{2,5})$ /gui?file=$2 [L]" # If not for /gui, but has an extension then send the request to gui
- "^/((?!api|gui\\/).+)*$ /gui?file=app.html&appName=sample-app [L]" # Any other request will always serve the app
# - "^/(gui\\/)?((?!api\\/).+)*$ /gui?file=$2" # Everything that is not under /api/ goes to gui
expressgui:
route: true # If it should automatically create a /gui route or not
dir: gui # Which directory to load the gui file from
root: <process.mainModule.filename directory> # Which directory to use as root, leave empty to use relative to the main file
public:
any: config set here will be delivered as config.json
NOTE: When using modrewrite and conf-stack (and defining routes other than in base.yaml) you might want to define modrewrite as an object with keys (0...100) and use the following to create the array
var rewrites = Object.keys(config.modrewrite||[]).sort().map(it=>config.modrewrite[it]).filter(it=>it);
, since confstack also merges arrays by index
Up to your implementation, but this is the suggested approach:
Create a properties.js within your gui/dynamic directory.
// Expose the properties globally
var PROPERTIES = {
config : ${configStr}
,user : "${user.username}"
}
In an app.html you can now load your propeties
<!DOCTYPE html>
<html>
<head>
<script src="properties.js"></script>
<script>
console.log(PROPERTIES);
</script>
</head>
<body></body>
</html>
configStr : JSON.stringify(config.public)
,config : config.public
,files : dynamicFilesMap
,anonymous : (req.session && req.session.anonymous) ? req.session.anonymous : {} // If the session has anonymous data then use it
,user : (req.session && req.session.user) ? req.session.user : {}
,session : req.session || {}
,appName : (req.query&&req.query.appName ? req.query.appName : 'main-app')
,query : req.query
,body : req.body
,req : req
,res : res
Use node-inspector through delay-debug
Refer to test directory. Use that setup.
FAQs
ExpressJS basic file delivery with a small layer of templating provided by lodash
The npm package express-gui receives a total of 1 weekly downloads. As such, express-gui popularity was classified as not popular.
We found that express-gui demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Four npm packages disguised as cryptographic tools steal developer credentials and send them to attacker-controlled Telegram infrastructure.
Security News
Ruby maintainers from Bundler and rbenv teams are building rv to bring Python uv's speed and unified tooling approach to Ruby development.
Security News
Following last week’s supply chain attack, Nx published findings on the GitHub Actions exploit and moved npm publishing to Trusted Publishers.