
Security News
The Hidden Blast Radius of the Axios Compromise
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.
Share objects across different Node.js processes. Write and read on both sides.
This package manages objects via IPC for you. When you create an object, it creates an equivalent on connected
processes. When you update that object, it updates the equivalent accordingly. And if you delete the object, it will
also delete the equivalent. This works both ways, so if you change the equivalent object in a subprocess, the original
will be changes as well.
npm i ipos
In the main process:
import child_process from 'child_process'
import IPOS from 'ipos'
// create a shared object instance
const sharedObject = IPOS.new()
// spawn a subprocess
// the ipc channel (4th stdio argument) is important
const subProcess = child_process.spawn('node', ['sub-process.js'], {
stdio: ['inherit', 'inherit', 'inherit', 'ipc']
})
// register the subprocess with IPOS
// await: to wait for the connection to be established
await sharedObject.addProcess(subProcess)
In the subprocess:
import IPOS from 'ipos'
// await: to wait for the connection to be established (await only in subprocess)
const sharedObject = await IPOS.new()
See example/main-process.js
and example/sub-process.js
.
To synchronise class instances, you first have to register the class with ipos on each process (on which the class
instance does not yet exist) before the synchronisation happens. That means if you want to connect two IPOS instances,
and the instance on the main process has a class instance somewhere inside a field, this class type must be registered
on the subprocess, before calling IPOS.new(). For IPOS to be able to transmit the class instance it has to have
methods to serialise (turn the class instance into either a string, a number, an object, an array, a map, or a set) and
deserialize (turn the serialised value back into a class instance). IPOS will look for .serialize(), or .stringify()
for serialisation and .from() for de-serialisation, but you can specify custom methods / functions. Here is an
example:
// example-class.js
export class Example {
data;
constructor(data) {
this.data = data
}
serialize() {
return this.data
}
static from(data) {
return new Example(data)
}
}
// main-process.js
import IPOS from 'ipos'
const exampleInstance = new Example('myValue')
const ipos = IPOS.new()
ipos.create('myClassInstance', exampleInstance)
const subProcess = child_process.spawn('node', ['sub-process.js'], {
stdio: ['inherit', 'inherit', 'inherit', 'ipc']
})
await sharedObject.addProcess(subProcess)
// sub-process.js
import IPOS from 'ipos'
import {Example} from './example-class.js'
const ipos = IPOS.registerClass(Example)
const ipos = await IPOS.new()
IPOS()The main class. Don't use the new keyword (when creating an instance in a subprocess). Instead, use the
static IPOS.new() method to create an instance.
static IPOS.new(): IPOS | Promise<IPOS>Creates a new instance. Multiple instances are not yet supported, so only create one instance per process.
Returns:
<IPOS> instance, if called in a normal processPromise<IPOS>, if called in a subprocess.ipos.addProcess(process: ChildProcess): Promise<void>Connect a subprocess to the IPOS instance. The subprocess must also
call IPOS.new() for the two processes' IPOS to connect.
Parameters:
process: ChildProcess The object of a subprocess IPOS should connect with. What gets returned
by child_process.exec(), child_process.execFile(), child_process.fork(), or child_process.spawn()Returns: Promise<void>. Use await to wait for the connection to the subprocess to be established.
ipos.removeProcess(process: ChildProcess): booleanDisconnect a subprocess to the IPOS instance. Closed subprocess automatically get disconnected.
Parameters:
process: ChildProcess The object of a subprocess IPOS should disconnect from. What gets returned
by child_process.exec(), child_process.execFile(), child_process.fork(), or child_process.spawn()Returns: boolean. true if a process was connected and has been disconnected, or false if the process was not
connected.
ipos.create(key: string, value: any)Create a field on the IPOS instance. This value can later be accessed or updated (See
ipos.get()). After creating a field, you can access and update it (even change the type)
with ipos[key: string] = value. See:
sharedObject.create('myValue', 23)
sharedObject.myValue = 'foo'
console.log(sharedObject.myValue) // -> 'foo'
ipos.create() can be called multiple times with the same key. Each time the old value will be overwritten.
Parameters:
key: string A unique key.value: any The value to be stored.ipos.get(key: string): anyGet an already created field from the IPOS instance. You can also use ipos[key: string] to access the value. If you
use a method on the value that changes the value, this change will also be reflected in the connected IPOS instances.
See:
sharedObject.create('myArray', [])
sharedObject.myArray.push('myString')
console.log(sharedObject.get('myArray')) // -> ['myString']
console.log(sharedObject.myArray) // -> ['myString']
And in a connected process, after 'myString' was pushed:
console.log(sharedObject.myArray) // -> ['myString']
Parameters:
key: string A unique key of an already created field.Returns: any. The stored value.
ipos.delete(key: string): booleanDeletes the field with the specified key.
Parameters:
key: string A unique key of an already created field.Returns: boolean. true if a field existed and has been removed, or false if the element does not exist.
FAQs
Share objects across different Node.js processes. Write and read on both sides.
The npm package ipos receives a total of 13 weekly downloads. As such, ipos popularity was classified as not popular.
We found that ipos demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.