
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
Find the primary node process in a multi server cluster.
This module finds the primary node in a cluster by inserting the nodes in a mongodb and choosing the primary by which node is the oldest. Each node checks into mongodb on a set timeout (default 1 minute). If the primary node dies for whatever reason, mongodb will expire the record and the next node in line will become the primary. Mongoose and a connection to a mongodb database is REQUIRED for is-primary to work.
Use cases for this module:
npm install is-primary
'use strict';
var mongoose = require('mongoose');
var node = require('is-primary');
// Start the mongoose db connection
mongoose.connect('mongodb://127.0.0.1:27017/test', function(err) {
if (err) {
console.error('\x1b[31m', 'Could not connect to MongoDB!');
throw (err);
}
});
// Start the is-primary worker
node.start();
// Check if this current process is the primary using the callback method
setInterval(function() {
node.isPrimary(function(err, results) {
if (err) return console.error(err);
console.log('Callback primary: ', results);
});
}, 5000);
// Check if this current process is the primary using the node.isPrimary method, this method only updates every time the process checks in
setInterval(function() {
console.log('Variable primary: ', node.primary);
}, 5000);
// Event emmiters that you can listen for
node.on('connected', function() {
console.log('The is-primary worker has connected and insterted into mongodb.');
});
node.on('synced', function() {
console.log('The is-primary worker has synced to mongodb.');
});
node.on('changed', function() {
console.log('The primary variable has changed');
});
node.on('primary', function() {
console.log('The process has been promoted to primary');
});
node.on('secondary', function(){
console.log('The process has been demoted to secondary');
});
When starting the worker, you can specify options in an object to update the default values.
node.start({
timeout: 120, // How often the nodes check into the database. This value is in seconds, default 60.
hostname: 'devServer1', // Sets the hostname of the node, without this value it will get the hostname using os.hostname.
collection: 'proc' // The mongodb collection is-primary will use. Please note that by default mongoose adds an 's' to the end to make it plural. Default value is 'node'.
});
Q. I updated the timeout option, but mongodb is not expiring the node in that timeout specified.
A. 60 seconds is added to the mongodb expire timeout to ensure the primary has time to checkin. Also please note, if this value is changed from the initial creation of the table, it will not be able to update the index. You will need to delete the table and then restart your server to re-create it.
For backward compatibility, the secondary event was also emitted with the historical name slave.
This is now removed
http://mattpker.com/2015/08/07/How-to-schedule-jobs-in-NodeJS/
npm test
In lieu of a formal styleguide, take care to maintain the existing coding style. Add unit tests for any new or changed functionality. Lint and test your code.
FAQs
Find the primary node process in a multi server cluster.
We found that is-primary demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.