
Security News
/Research
Wallet-Draining npm Package Impersonates Nodemailer to Hijack Crypto Transactions
Malicious npm package impersonates Nodemailer and drains wallets by hijacking crypto transactions across multiple blockchains.
An in-memory graph database for JavaScript data.
Moderately used in at least one real product. Expected to become more widely deployed and battle tested real soon.
The most direct inspiration is DataScript, which is in turn inspired by Datomic. Like DataScript, but unlike Datomic, this "database" does not offer durability of any kind.
Further inspiration comes from Facebook's Relay and Netflix's Falcor. Unlike either of these, this project does not attempt to address any networking and service challenges.
Lastly, this project is inspired by Om Next and discussions with its creator, David Nolen.
We've already got a growing set of JSON/REST APIs, so we can't easily switch everything to a Relay or Falcor style service endpoint overnight.
Our frontend is already written in JavaScript, utilizing React.js; ClojureScript is too large of a leap for our team at this time.
We need something that's, above all else, simple, but acts as a stepping stone along the path towards frontend nirvana.
import Database from 'jseg';
let db = new Database(schema);
The only field provided by the default schema, lid
, is required. It is short
for "Local ID" and is named such to differentiate it from other application
specific identifiers. The recommended name for server-specified identifiers is
"gid", short for "Global ID".
See below for methods of db
and schema details.
See [the test file][./test/index.js] for many concrete examples.
Gets a whole tree of related objects by lid
.
Does not traverse in to cycles.
Null field values and empty collections are omitted.
Always returns an object, with at least a lid
field.
Puts a whole tree of related objects. Properties are merged in to existing
objects with matching lid
fields.
Fields set to null are deleted from entities.
Gets an object by a unique field string value. See schema.
Returns null if no entity exists.
Removes an object from the database by lid. Recurses as per schema.
Removes a related object from a reference collection field.
Also works on non-collection reference fields. Treats the field as a collection with a max size of one. Equivalent to setting the field to null.
Just a map of named fields to config.
The lid
property is required for all get/put operations. It's just a string.
unique: true
Use on string fields to enable O(1) indexing for use by lookup
.
The validate
property specifies a function to validate and transform a
scalar value. Throw an exception to report a validation error or return the
transformed value.
Validation errors are logged and invalid fields are discarded.
validate: function(value) {
if (!valid(value)) {
throw validationError;
}
return coerce(value);
}
ref: 'reverse'
Specifies which fields are references to other objects, and those object's reverse relationship field name. Neither, either, or both ends of the relationship may be collections.
For example:
let schema = {
owner: {
ref: 'tickets',
collection: true,
},
tickets: {
ref: 'owner',
},
};
Use field value of {lid: ...}
for related objects:
db.put({lid: 'ticket1', owner: 'user1'});
db.put({lid: 'user1', tickets: [{lid: 'ticket2'}]});
ref: 'reverse',
collection: true,
sort: function compare(x, y) {
...
}
An array field value adds entities in to a set. The sort comparator is
optional. To remove entities, see remove
.
destroy: true
Use on ref fields to recursively call destroy
.
FAQs
JavaScript Entity Graph: A super simple, in-memory, JS graph database.
The npm package jseg receives a total of 1 weekly downloads. As such, jseg popularity was classified as not popular.
We found that jseg demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
/Research
Malicious npm package impersonates Nodemailer and drains wallets by hijacking crypto transactions across multiple blockchains.
Security News
This episode explores the hard problem of reachability analysis, from static analysis limits to handling dynamic languages and massive dependency trees.
Security News
/Research
Malicious Nx npm versions stole secrets and wallet info using AI CLI tools; Socket’s AI scanner detected the supply chain attack and flagged the malware.