Research
Security News
Malicious npm Package Targets Solana Developers and Hijacks Funds
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
The fbp library provides a parser for the FBP domain-specific language used for defining graphs for flowbased programming environments like NoFlo. For more, see the documentation on the NoFlo site.
You can use the FBP parser in your JavaScript code with the following:
var parser = require('fbp');
// Some FBP syntax code
var fbpData = "'hello, world!' -> IN Display(Output)";
// Parse into a Graph definition JSON object
var graphDefinition = parser.parse(fbpData);
After this the graph definition can be loaded into a compatible flow-based runtime environment like NoFlo.
The fbp package also provides a command-line tool for converting FBP files into JSON:
$ fbp somefile.fbp > somefile.json
FBP is a Domain-Specific Language (DSL) for easy graph definition. The syntax is the following:
'somedata' -> PORT Process(Component)
sends initial data somedata to port PORT of process Process that runs component ComponentA(Component1) X -> Y B(Component2)
sets up a connection between port X of process A that runs component Component1 and port Y of process B that runs component Component2You can connect multiple components and ports together on one line, and separate connection definitions with a newline or a comma (,
).
Components only have to be specified the first time you mention a new process. Afterwards, simply use the process name.
Example:
'somefile.txt' -> SOURCE Read(ReadFile) OUT -> IN Split(SplitStr)
Split OUT -> IN Count(Counter) COUNT -> IN Display(Output)
Read ERROR -> IN Display
The syntax also supports blank lines and comments. Comments start with the #
character.
Example with the same graph than above :
# Read the content of "somefile.txt" and split it by line
'somefile.txt' -> SOURCE Read(ReadFile) OUT -> IN Split(SplitStr)
# Count the lines and display the result
Split() OUT -> IN Count(Counter) COUNT -> IN Display(Output)
# The read errors are also displayed
Read() ERROR -> IN Display()
When FBP-defined graphs are used as subgraphs in other flows, it is often desirable to give more user-friendly names to their available ports. In the FBP language this is done by INPORT
and OUTPORT
statements.
Example:
INPORT=Read.IN:FILENAME
Read(ReadFile) OUT -> IN Display(Output)
This line would export the IN port of the Read node as FILENAME.
It is possible to append metadata to Nodes when declaring them by adding the metadata string to the Component part after a colon (:
).
Example:
'somefile.txt' -> SOURCE Read(ReadFile:main)
Read() OUT -> IN Split(SplitStr:main)
Split() OUT -> IN Count(Counter:main)
Count() COUNT -> IN Display(Output:main)
Read() ERROR -> IN Display()
In this case the route leading from Read to Display through Split and Count would be identified with the string main. You can also provide arbitrary metadata keys with the =
syntax:
Read() OUT -> IN Split(SplitStr:foo=bar,baz=123)
In this case the Split node would contain the metadata keys foo
and baz
with values bar
and 123
.
fbp 1.1.4 - released 05.10.2015
-
in node namesFAQs
Parser for the .fbp flow definition language
The npm package fbp receives a total of 318 weekly downloads. As such, fbp popularity was classified as not popular.
We found that fbp demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
Security News
Research
Socket researchers have discovered malicious npm packages targeting crypto developers, stealing credentials and wallet data using spyware delivered through typosquats of popular cryptographic libraries.
Security News
Socket's package search now displays weekly downloads for npm packages, helping developers quickly assess popularity and make more informed decisions.