Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Gun-Flint is a package that makes it easy to write adapters to connect your Gun database to various services (like databases, Pusher, etc.). Gun-Flint is not itself an adapter.
npm install gun-flint
or
yarn add gun-flint
Since Gun is a graph database, its data structure requires some special consideration. Gun-Flint attempts to provide as much flexibility for the adapter developer to store data in a format that makes sense for the storage system you are using.
Building your Gun-Flint gives you an advantage of allowing Flint to ensure that the data coming from Gun reaches your adapter in a consistent format and returns data to Gun in a format that it recognizes.
get
request expect to read an entire Gun node; put
requests write an entire node.
Pros:
Cons:
users
node with millions of user
s)When to Use: Most/all nodes are small; nodes are frequently created; optimal for document-based databases (e.g., MongoDB; Postgres)
Example: gun-mongo
get
request returns an array/list of nodes properties; put
requests write batch updates to specific node's key:value pairs.
Pros:
Cons:
When to Use: Nodes are small/medium in size; some large nodes; nodes are frequently updated
Example: gun-mongo-key
get
request return an entire node, formatted in a way Gun recognizes; put
requests receive a delta (diff) of node properties as well as conflict-resolution state indicators.
Pros:
Cons:
When to Use: You need total control of storage format and one of the above formats is not sufficient.
Whichever storage method you decide, your adapter needs to only implement three methods: opt, get, put. See the documentation for each storage method as the exact API depends on the method selected.
Stripped down, the API looks like this:
const {Flint, NodeAdapter} = require('gun-flint');
const myGunAdapter = new NodeAdapter({
opt: function(context, options) {
// etc
},
get: function(key, field, done) {
// handle read
},
put: function(node, done) {
// handle write
}
});
Flint.register(myGunAdapter);
In the end, the good users of your adapter should install it like this:
var Gun = require('gun');
// Adapter must come after requiring Gun but before `new Gun`
require('your-awesome-adapter');
// Adapters all set up? Instantiate Gun.
var gun = new Gun({
myAwesomeAdapter: {
key: "This gets passed into the `opt` call when gun is initialized. Useful for allowing those who use your adapter to pass in DB drivers of the like."
}
});
Flint comes packaged with an integration testing suite. See full documentation here.
Flint comes packaged with an performance suite that will run against your adapter. See full documentation here.
If your adapter's opt
function is never called, or when it is called, it doesn't have options that you passed to the constructor, here are some steps:
peerDependencies
or devDependencies
, especially the later if you need it for testing your adapter.npm list -g --depth=0
to check), and npm uninstall -g gun
if it is.node_modules
and install a fresh set (preferably from a lockfile)FAQs
Micro-framework for building Gun adapters
The npm package gun-flint receives a total of 6 weekly downloads. As such, gun-flint popularity was classified as not popular.
We found that gun-flint demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.