Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
:warning: NOTE :warning:
Version 0.x.x (flamelink@latest) of the SDK only supports the Firebase Realtime Database, and is being deprecated.
Please consider upgrading to the "@next" version of the SDK (flamelink@next) which supports both Cloud Firestore and the Realtime Database
Alternatively please ensure you have specified a fixed version in your package manager file ("flamelink": "0.19.14") to avoid updating to the latest version of Flamelink on your next installation
Easily integrate with your Flamelink CMS.
This SDK is intended to be used in a browser or on a NodeJS server environment.
If you are unfamiliar with Flamelink, please visit our flamelink.io website for more info on features, pricing and more.
NOTE: THIS SDK SUPPORTS THE FIREBASE REALTIME DATABASE ONLY.
If you are looking for Cloud Firestore support, please use our new SDK that supports both.
It goes without saying that you will need to have a Flamelink project for this SDK to be of any use to you.
Apart from the Flamelink project, the only real hard dependency is either the Firebase JavaScript SDK or Firebase Admin SDK, depending on whether you use Flamelink from the browser or server. Take a look at the installation instructions on their README, but in short, just make sure you add firebase
or firebase-admin
as a dependency to your project.
Once you have firebase
installed, you can install flamelink
using any of the following options (we recommend installing with npm
or yarn
):
Install with npm
npm install --save flamelink
or with yarn
yarn add flamelink
or with a <script>
tag hosted from any of these CDN's
Add the following script tag to the <body>
of your index.html file:
<script src="//cdn.jsdelivr.net/npm/flamelink/dist/flamelink.js"></script>
This will always load the latest version of this SDK for you. If you want to load a specific version, you can specify the version number as well (1.0.0 in the example):
<script src="//cdn.jsdelivr.net/npm/flamelink@1.0.0/dist/flamelink.js"></script>
See the jsDelivr website for more options
Add the following script tag to the <body>
of your index.html file:
<script src="//unpkg.com/flamelink/dist/flamelink.js"></script>
This will always load the latest version of this SDK for you. If you want to load a specific version, you can specify the version number as well (1.0.0 in the example):
<script src="//unpkg.com/flamelink@1.0.0/dist/flamelink.js"></script>
See the unpkg website for more options
First ensure that you load the flamelink
package to your file. When using the <script>
tag version, you will need to load both firebase
and flamelink
which will then be globally available on the browser's window
object.
Depending on your app setup, you can import the package using require()
statements:
var flamelink = require('flamelink');
or using ES2015/ES6 imports:
import flamelink from 'flamelink';
You can create your flamelink
app instance by passing in an existing firebaseApp
instance along with all the other flamelink
config options (if using this option you need to remember to import firebase
or firebase-admin
yourself):
import * as firebase from 'firebase';
import flamelink from 'flamelink';
const firebaseConfig = {
apiKey: '<your-api-key>', // required
authDomain: '<your-auth-domain>', // required
databaseURL: '<your-database-url>', // required
projectId: '<your-project-id>', // required
storageBucket: '<your-storage-bucket-code>', // required
messagingSenderId: '<your-messenger-id>' // optional
};
const firebaseApp = firebase.initializeApp(firebaseConfig);
const app = flamelink({ firebaseApp });
?> Tip: Go to your Firebase console to find these config settings.
When using the firebase-admin
SDK on server-side, you need to specify a isAdminApp
property along with your firebaseApp
instance, like this:
const admin = require('firebase-admin');
const flamelink = require('flamelink');
const serviceAccount = require('path/to/serviceAccountKey.json');
const firebaseConfig = {
credential: admin.credential.cert(serviceAccount), // required
databaseURL: '<your-database-url>', // required
storageBucket: '<your-storage-bucket-code>' // required if you want to your any Storage functionality
};
const firebaseApp = admin.initializeApp(config);
const app = flamelink({ firebaseApp, isAdminApp: true }); // Remember `isAdminApp: true` here!!!
You can use any of the different ways to create the admin firebaseApp instance, as long as you remember to set the
isAdminApp: true
option.
Once you have an instance of the flamelink
app, you can start using it to interact with your data stored in your firebase database. Suppose you want to retrieve all your products created under the "Content" section in flamelink
.
Using standard Promises:
app.content.get('products')
.then(products => console.log('All of your products:', products))
.catch(error => // handle any errors)
Using async-await:
const products = await app.content.get('products');
console.log('All of your products:', products);
Read our docs for more specifics!
🔥🔥🔥 Flame on!! 🔥🔥🔥
FAQs
Javascript SDK for integrating with Flamelink CMS
The npm package flamelink receives a total of 366 weekly downloads. As such, flamelink popularity was classified as not popular.
We found that flamelink demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 3 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.