Research
Security News
Quasar RAT Disguised as an npm Package for Detecting Vulnerabilities in Ethereum Smart Contracts
Socket researchers uncover a malicious npm package posing as a tool for detecting vulnerabilities in Etherium smart contracts.
Ivy is node.js queue library focused on easy, yet flexible task execution.
Installation is done via NPM, by running npm install ivy
var ivy = require('ivy');
var factorial = function factorial(number, callback) {
callback(null, 42);
}
var finished = function resolved(result) {
console.log('result is', result);
}
// task must be explicitly registered for now
// we'd like to change that in the future
// Also, task must be both available and registered on both client
// and producer
// ...and name must be unique globally. "package.module.submodule.function"
// pattern is highly encouraged.
ivy.registerTask(factorial, finished, {
'name': 'testpackage.factorial',
'queue': 'testpackage' //,
// 'route': 'testpackage.route1',
// 'priority': 0,
// retry: true,
// maxRetries: 10
});
if (process.env.NODE_ENV==='producer') {
ivy.setupQueue({
type: 'ironmq',
auth: {
token: process.env.IRONMQ_TOKEN || 'dummy',
project_id: process.env.IRONMQ_PROJECT_ID || 'testpackage'
}
//, queue: 'testpackage' // optional, inferred from task
});
// optional, only if callback is registered
ivy.startNotificationConsumer({
'type': 'redis',
'url': 'redis://name:password@hostname:port'
});
// execute task
ivy.delayedCall(factorial, 5, function(err, result) {
console.log("Factorial result is", result);
});
}
elseif (process.env.NODE_ENV==='worker') {
ivy.startNotificationProducer({
'type': 'redis',
'url': 'redis://name:password@hostname:port'
});
ivy.listen({
queue: 'testpackage',
type: 'ironmq',
auth: {
token: process.env.IRONMQ_TOKEN || 'dummy',
project_id: process.env.IRONMQ_PROJECT || 'testpackage'
},
// optional
messages: {
'testpackage.factorial': {
reserveTime: 60*60
}
}
});
}
Ivy touches the following workflow:
Only tasks/functions with async interface supported. Assumptions:
Think about context change
Explicit is better then implicit
listen
is invoked, producer when first delayedCall
is executed. Make it explicit in v1, we'll see later.Task registries must be same on both sides
Serialization boundaries
There are a lot of parts and components in distributed environment. This is how Ivy
understands them.
ivy.delayedCall
has been called.Queue
services, Message
's are organized into separate, well, queues, identified by name. To avoid naming clashes, those are always referred to as Queue names
instead of just "queues".Queue
's role, i.e. IronMQ
, SQS
, RabbitMQ
, ...Queue
and processing them.Consumer
that listens to Queue
and waits for Message
sQueue
, understood on both ends.Message
into Queue
, i.e. JSON.Message serialization
, i.e. {"task": "taskname", "arguments": []}
migth be an example Message format
for JSON Message serialization
.Consumer
. May be parametrized by Message
's content.Task
at some point.Scheduled Task
or Task
. May be scheduled
(successfully placed in Queue
, but not consumed by Consumer
yet), running
(processing on consumer), errored
(some state failed), successfull
(processing done on consumer and Notifier
successfully notified) and done
(successfull
+ Producer
successfully notified).Task
upon its completion with the intent of informing Producer
about it. While the primary purpose might be computation task that produces an output that is stored in database, it is not considered Task result
if it's not intended for Producer
. Result is an array of arguments given to Task
's callback.Consumer
.Task
excluding the last one (that must be callback. I.e. for function factorial = (number, cb)
, the arguments
are [number]
, i.e. [5]
.ScheduledTask
by serializing original delayedCall
call into Message
and putting it in Queue
.Messages
from Queue
on Consumer
done by Listener
.Producer
, done by calling callback passed to original delayedCall
.Producer
notified -- or there has been an error.Producer
about Task status
and/or Task result
. Might be same piece of software/service as Queue
.Task result
s from any Consumer
to particular Producer
.Notifier
's role, i.e. IronMQ
, Redis
, ...If you can encrypt all messages for better security add encryptionKey as password. We use aes-256-cbc
algorithm for encrypt and decrypt messages.
ivy.setupQueue({
queue: 'testpackage',
type: 'ironmq',
auth: {
token: process.env.IRONMQ_TOKEN || 'dummy',
project_id: process.env.IRONMQ_PROJECT_ID || 'testpackage'
},
encryptionKey: process.env.MESSAGES_ENCRYPTION_KEY
});
npm -g install grunt-cli
grunt
grunt bump
grunt bump:minor
grunt bump:major
and
npm publish
docker-compose build
docker-compose run ivy
FAQs
Queue wrapper with node.js-ish interface.
We found that ivy demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 6 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket researchers uncover a malicious npm package posing as a tool for detecting vulnerabilities in Etherium smart contracts.
Security News
Research
A supply chain attack on Rspack's npm packages injected cryptomining malware, potentially impacting thousands of developers.
Research
Security News
Socket researchers discovered a malware campaign on npm delivering the Skuld infostealer via typosquatted packages, exposing sensitive data.