
Research
Security News
Malicious PyPI Package Exploits Deezer API for Coordinated Music Piracy
Socket researchers uncovered a malicious PyPI package exploiting Deezer’s API to enable coordinated music piracy through API abuse and C2 server control.
A light callable lib to keep your Node.Js API alive
npm i guardflux
This is expansion of Joi lib that we use it to verify API input. It can be query
or body
of a request. Here is the example of usage:
const ipSchema = schema.object({
api_key: schema.string().min(10).max(10).required(),
})
Then you can verify the input with checkObject()
function and it returns result with two elements isValid: boolean
and log: any
. isValid
returns true
if given object and schema match and log
returns Joi
log if an error happen. Also this function has an element called devMode
that prints all logs in console
to get what is happening in function and defult setted to true
. Here is the full example:
import { checkObject, schema } from 'guardflux'
import { CheckResult } from 'guardflux/dist/lib/types'
...
// This is the apikey or user ip or id that you can pass to function
const user_given_api_key: string = "x2a45B78C0"
const ipSchema = schema.object({
api_key: schema.string().min(10).max(10).required(),
})
const check: CheckResult = await checkObject({ api_key: user_given_api_key }, ipSchema)
You can use check.isValid
to response the user that given data in request is valid or not.
This is a very useful fucntion that make rate limit for every route based on user api-key/id/ip that you pass. We use MikroOrm because it is light and can handle several DBs. Because of needing to save data in DB we have to config the DB options first:
const dbOptions: DbConfig = {
dbName: "guardflux", // Default name id "guardflux" but you can pass any name you want
dbType: "mongodb", // Choose which DB you want to work with it. Supported DBs are 1-MySQL 2-MongoDB 3-PostgreSQL
dbURI: MONGO_URI, // Pass URI of your DB
dbDebug: true // Make MikroOrm debug mode on
}
If your DB has username and password, you can add it to you URI string. These are default DBs URI string that don't have username and password.
Type | default connection url |
---|---|
mongo | mongodb://127.0.0.1:27017 |
mysql | mysql://root@127.0.0.1:3306 |
postgresql | postgresql://postgres@127.0.0.1:5432 |
After we config the DB, we have to add options
for rateLimit
function:
const rlOptions: RateLimitOptions = {
route: "/api/test_route", // API route to specify ratelimit based on route
cycleTime: 60, // Rate limit cycle based on secounds
maxRequests: 5 // Max requests that a user can make in cycleTime
}
Now we pass all consts to function. This function works based on two keys: 1- User API-key/ip/id 2- Route path. At least you can turn devMode
to see in console what is happen. Like checkObject
function, this method has devMode
too that is enabled by default.This option will prints all data of MikroOrm
and what is happen in function. This function returns like checkObject
and you can use it to response the user if you want. All example is here:
import { checkObject, schema } from 'guardflux'
import { CheckResult } from 'guardflux/dist/lib/types'
...
// This is the apikey or user ip or id that you can pass to function
const user_given_api_key: string = "x2a45B78C0"
const rlOptions: RateLimitOptions = {
route: "/api/test_route", // API route to specify ratelimit based on route
cycleTime: 60, // Rate limit cycle based on secounds
maxRequests: 5 // Max requests that a user can make in cycleTime
}
const dbOptions: DbConfig = {
dbName: "guardflux", // Default name id "guardflux" but you can pass any name you want
dbType: "mongodb", // Choose which DB you want to work with it. Supported DBs are 1-MySQL 2-MongoDB 3-PostgreSQL
dbURI: MONGO_URI, // Pass URI of your DB
dbDebug: true // Make MikroOrm debug mode on
}
const rl: CheckResult = await rateLimit(user_given_api_key, rlOptions, dbOptions)
This project is licensed under the MIT License - see the LICENSE file for details.
FAQs
A light callable lib to keep your API alive
The npm package guardflux receives a total of 5 weekly downloads. As such, guardflux popularity was classified as not popular.
We found that guardflux demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket researchers uncovered a malicious PyPI package exploiting Deezer’s API to enable coordinated music piracy through API abuse and C2 server control.
Research
The Socket Research Team discovered a malicious npm package, '@ton-wallet/create', stealing cryptocurrency wallet keys from developers and users in the TON ecosystem.
Security News
Newly introduced telemetry in devenv 1.4 sparked a backlash over privacy concerns, leading to the removal of its AI-powered feature after strong community pushback.