
Research
Namastex.ai npm Packages Hit with TeamPCP-Style CanisterWorm Malware
Malicious Namastex.ai npm packages appear to replicate TeamPCP-style Canister Worm tradecraft, including exfiltration and self-propagation.
A pure-disk based least-recently-used (LRU) cache.
Nothing is kept in memory. This has the benefit of persisting across application restarts, and not taking up any RAM.
The cache is constrained by size (bytes), and optionally by file age.
filru is much slower than an in-memory cache, so use cases are:
Node.js >= version 6
npm install filru
const Filru = require('filru');
const require('request-promise-native'); // optional for loading async when not in cache
const handleErr = (err) => {
throw err;
};
const maxBytes = 50 * 1024 * 1024; // 50 megabytes
const maxAge = 24 * 60 * 60 * 1000; // 1 day
const hashSeed = 'cache4gold'; // optional, random seed string
const pruneInterval = 1000 * 60 * 60; // optional, defaults to 1 hour
const f = new Filru({ dir: '/tmp/filru', maxBytes, maxAge, hashSeed, pruneInterval });
// optionally add a load function for when an object
// is not found in the cache
f.load = function customLoad(key) {
// Custom async load function must return a promise.
return request.get('https://my-site.com/' + key);
};
f.start()
.then(() => {
// fill the cache
f.set('jimmy.txt', 'yo').catch(handleErr);
f.get('jimmy.txt')
.then((buffer) => {
console.log('got jimmy:', buffer.toString('utf8')); // "yo"
})
.catch(handleErr);
// stop cleanup job
f.stop();
})
.catch(err => {
throw err;
});
npm test
Run your application with DEBUG=filru*
MIT
See LICENSE file in the root of this directory.
FAQs
least-recently-used cache for files on disk
The npm package filru receives a total of 3 weekly downloads. As such, filru popularity was classified as not popular.
We found that filru demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Malicious Namastex.ai npm packages appear to replicate TeamPCP-style Canister Worm tradecraft, including exfiltration and self-propagation.

Product
Explore exportable charts for vulnerabilities, dependencies, and usage with Reports, Socket’s new extensible reporting framework.

Product
Socket for Jira lets teams turn alerts into Jira tickets with manual creation, automated ticketing rules, and two-way sync.