Research
Security News
Malicious npm Package Targets Solana Developers and Hijacks Funds
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
The fbp library provides a parser for a domain-specific language for flow-based-programming (FBP), used for defining graphs for FBP programming environments like NoFlo, MicroFlo and MsgFlo.
You can use the FBP parser in your JavaScript code with the following:
var parser = require('fbp');
// Some FBP syntax code
var fbpData = "'hello, world!' -> IN Display(Output)";
// Parse into a Graph definition JSON object
var graphDefinition = parser.parse(fbpData, {caseSensitive: true});
When caseSensitive
is false
the parser will convert port names to lowercase. This is currently the default behavior, but in future releases the default will change to preserve case. It is therefore recommended that you always specify the caseSensitive
option to make your code future-proof.
The fbp package also provides a command-line tool for converting FBP files into JSON:
$ fbp somefile.fbp [--case-sensitive] > somefile.json
And for converting JSON files into FBP:
$ fbp somefile.json [--case-sensitive] > somefile.fbp
FBP is a Domain-Specific Language (DSL) for easy graph definition. The syntax is the following:
'somedata' -> PORT Process(Component)
sends initial data somedata to port PORT of process Process that runs component ComponentA(Component1) X -> Y B(Component2)
sets up a connection between port X of process A that runs component Component1 and port Y of process B that runs component Component2You can connect multiple components and ports together on one line, and separate connection definitions with a newline or a comma (,
).
Components only have to be specified the first time you mention a new process. Afterwards, simply use the process name.
Example:
'somefile.txt' -> SOURCE Read(ReadFile) OUT -> IN Split(SplitStr)
Split OUT -> IN Count(Counter) COUNT -> IN Display(Output)
Read ERROR -> IN Display
The syntax also supports blank lines and comments. Comments start with the #
character.
Example with the same graph than above :
# Read the content of "somefile.txt" and split it by line
'somefile.txt' -> SOURCE Read(ReadFile) OUT -> IN Split(SplitStr)
# Count the lines and display the result
Split() OUT -> IN Count(Counter) COUNT -> IN Display(Output)
# The read errors are also displayed
Read() ERROR -> IN Display()
When FBP-defined graphs are used as subgraphs in other flows, it is often desirable to give more user-friendly names to their available ports. In the FBP language this is done by INPORT
and OUTPORT
statements.
Example:
INPORT=Read.IN:FILENAME
Read(ReadFile) OUT -> IN Display(Output)
This line would export the IN port of the Read node as FILENAME.
It is possible to append metadata to Nodes when declaring them by adding the metadata string to the Component part after a colon (:
).
Example:
'somefile.txt' -> SOURCE Read(ReadFile:main)
Read() OUT -> IN Split(SplitStr:main)
Split() OUT -> IN Count(Counter:main)
Count() COUNT -> IN Display(Output:main)
Read() ERROR -> IN Display()
In this case the route leading from Read to Display through Split and Count would be identified with the string main. You can also provide arbitrary metadata keys with the =
syntax:
Read() OUT -> IN Split(SplitStr:foo=bar,baz=123)
In this case the Split node would contain the metadata keys foo
and baz
with values bar
and 123
.
FBP graphs also support annotations for specifying things like graph name, description, icon, or the FBP runtime to be used for executing the graph.
The syntax for annotations is # @name value
, for example:
# @runtime noflo-nodejs
# @name ReadSomefile
'somefile' -> SOURCE Read(ReadFile)
FAQs
Parser for the .fbp flow definition language
We found that fbp demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
Security News
Research
Socket researchers have discovered malicious npm packages targeting crypto developers, stealing credentials and wallet data using spyware delivered through typosquats of popular cryptographic libraries.
Security News
Socket's package search now displays weekly downloads for npm packages, helping developers quickly assess popularity and make more informed decisions.