Research
Security News
Quasar RAT Disguised as an npm Package for Detecting Vulnerabilities in Ethereum Smart Contracts
Socket researchers uncover a malicious npm package posing as a tool for detecting vulnerabilities in Etherium smart contracts.
fn-machine
Advanced tools
A tiny, functional, state machine utility
npm install --save fn-machine
fn-machine consists of 3 functions. The first two are used to define a machine:
machine([State], 'initialState', initialContextObj, stateChangeCallback, loggerFn)
state('name', transitionsObj, enterFunction, exitFunction)
The third function is what would traditionally be called a send()
function. This function is returned by calling machine(...)
.
// import the setup functions
import {machine, state} from 'fn-machine';
// initial context object
const initialContext = {
loading: false,
users: [],
};
function loadUsers() {
// simulate a network request
setTimeout(() => {
// once the request completes, we can call `myMachine` (the 'send' function).
myMachine('loaded', {users:['foo', 'bar']})
}, 1000);
};
// initialize a machine
const myMachine = machine([
state('initial', {
// each method on this object represents a transition for this particular state.
loadData: (detail, context) => {
// a transition should return the new state, as well as the optional context.
// here we return {state:'loadingData'} to signify we want the state to now be 'loadingData'.
return {
state:'loadingData',
}
}
}),
state('loadingData', {
loaded: (detail, context) => {
return {
state: 'loadedData',
context: {...context, ...detail, ...{loading: false}}
}
}
}, context => {// call loadUsers when this state is entered, and return the new context.
loadUsers();
return {...context, ...{loading: true}};
}),
state('loadedData', {}) // 'loadedData' is an empty/final state. There are no transitions.
], 'initial', initialContext, newState => {
console.log('myMachine state changed:', newState.state, newState.context);
}, console.log);// pass an optional logger function
In the loadUsers()
function above, we invoke the third function provided by fn-machine, which is the send function. The send function takes a string as the first parameter, which is the name of a transition we'd like to invoke, and optionally a detail
object, which contains some data we want the machine to work with, and/or update the context with.
You can also define transitions using a short-hand syntax like so:
state('myState', {
someAction: 'newState',
});
which is equivelent to:
state('myState', {
someAction: (detail, context) => {
return {
state: 'newState',
context: {...context, ...detail},
};
},
});
There is an example in this repo, or you can play around with this codepen that shows a basic integration with LitElement.
There are two utility functions to convert to and from mermaid syntax.
toMermaid([state('on', {powerOff: 'off'}, state('off', {powerOn: 'on'}))], 'off');
produces a string like that you can process with mermaidjs to visualize your machine:
stateDiagram-v2
[*] --> off
on --> off: powerOff
off --> on: powerOn
Or, you can take a mermaid string and output some stub javascript:
const mermaidStr = `
stateDiagram-v2
[*] --> off
on --> off: powerOff
off --> on: powerOn
`;
fromMermaid(mermaidStr);
which produces:
[state('on', {powerOff: 'off'}, state('off', {powerOn: 'on'}))]
These are useful for visualization and initial creation of your machines, but beware that if your machine transitions contain logic, that logic would be lost should you try to go full circle: machine -> mermaid -> machine.
Yes! PR's are welcome. Tests are written in mocha. Run with npm run test
or yarn test
. Typechecking is provided by typescript via JSDoc annotations.
FAQs
a tiny functional state machine
The npm package fn-machine receives a total of 193 weekly downloads. As such, fn-machine popularity was classified as not popular.
We found that fn-machine demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket researchers uncover a malicious npm package posing as a tool for detecting vulnerabilities in Etherium smart contracts.
Security News
Research
A supply chain attack on Rspack's npm packages injected cryptomining malware, potentially impacting thousands of developers.
Research
Security News
Socket researchers discovered a malware campaign on npm delivering the Skuld infostealer via typosquatted packages, exposing sensitive data.