
Research
Security News
Malicious PyPI Package Exploits Deezer API for Coordinated Music Piracy
Socket researchers uncovered a malicious PyPI package exploiting Deezer’s API to enable coordinated music piracy through API abuse and C2 server control.
The fbp library provides a parser for a domain-specific language for flow-based-programming (FBP), used for defining graphs for FBP programming environments like NoFlo, MicroFlo and MsgFlo.
You can use the FBP parser in your JavaScript code with the following:
var parser = require('fbp');
// Some FBP syntax code
var fbpData = "'hello, world!' -> IN Display(Output)";
// Parse into a Graph definition JSON object
var graphDefinition = parser.parse(fbpData, {caseSensitive: true});
When caseSensitive
is false
the parser will convert port names to lowercase. This is currently the default behavior, but in future releases the default will change to preserve case. It is therefore recommended that you always specify the caseSensitive
option to make your code future-proof.
The fbp package also provides a command-line tool for converting FBP files into JSON:
$ fbp somefile.fbp [--case-sensitive] > somefile.json
And for converting JSON files into FBP:
$ fbp somefile.json [--case-sensitive] > somefile.fbp
FBP is a Domain-Specific Language (DSL) for easy graph definition. The syntax is the following:
'somedata' -> PORT Process(Component)
sends initial data somedata to port PORT of process Process that runs component ComponentA(Component1) X -> Y B(Component2)
sets up a connection between port X of process A that runs component Component1 and port Y of process B that runs component Component2You can connect multiple components and ports together on one line, and separate connection definitions with a newline or a comma (,
).
Components only have to be specified the first time you mention a new process. Afterwards, simply use the process name.
Example:
'somefile.txt' -> SOURCE Read(ReadFile) OUT -> IN Split(SplitStr)
Split OUT -> IN Count(Counter) COUNT -> IN Display(Output)
Read ERROR -> IN Display
The syntax also supports blank lines and comments. Comments start with the #
character.
Example with the same graph than above :
# Read the content of "somefile.txt" and split it by line
'somefile.txt' -> SOURCE Read(ReadFile) OUT -> IN Split(SplitStr)
# Count the lines and display the result
Split() OUT -> IN Count(Counter) COUNT -> IN Display(Output)
# The read errors are also displayed
Read() ERROR -> IN Display()
When FBP-defined graphs are used as subgraphs in other flows, it is often desirable to give more user-friendly names to their available ports. In the FBP language this is done by INPORT
and OUTPORT
statements.
Example:
INPORT=Read.IN:FILENAME
Read(ReadFile) OUT -> IN Display(Output)
This line would export the IN port of the Read node as FILENAME.
It is possible to append metadata to Nodes when declaring them by adding the metadata string to the Component part after a colon (:
).
Example:
'somefile.txt' -> SOURCE Read(ReadFile:main)
Read() OUT -> IN Split(SplitStr:main)
Split() OUT -> IN Count(Counter:main)
Count() COUNT -> IN Display(Output:main)
Read() ERROR -> IN Display()
In this case the route leading from Read to Display through Split and Count would be identified with the string main. You can also provide arbitrary metadata keys with the =
syntax:
Read() OUT -> IN Split(SplitStr:foo=bar,baz=123)
In this case the Split node would contain the metadata keys foo
and baz
with values bar
and 123
.
fbp 1.5.0 - released 06.07.2016
fbp.serialize(graph)
fbp somegraph.json
serialize back to FBP DSLFAQs
Parser for the .fbp flow definition language
The npm package fbp receives a total of 183 weekly downloads. As such, fbp popularity was classified as not popular.
We found that fbp demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket researchers uncovered a malicious PyPI package exploiting Deezer’s API to enable coordinated music piracy through API abuse and C2 server control.
Research
The Socket Research Team discovered a malicious npm package, '@ton-wallet/create', stealing cryptocurrency wallet keys from developers and users in the TON ecosystem.
Security News
Newly introduced telemetry in devenv 1.4 sparked a backlash over privacy concerns, leading to the removal of its AI-powered feature after strong community pushback.