Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Trail is a router for koa with the option to explicitly execute multiple routes on a single request (similar to express routing).
For example, instead of:
var koa = require('koa');
var trail = require('koa-trail');
var app = koa();
app.use(trail(app));
function authenticate *(next) {
// ... authenticate the API token
if (!user)
this.throw(403, 'API Token Invalid');
else
yield next
}
// chain the authenticate on every route
app.get('/api/users', authenticate, apiController.getUsers);
app.get('/api/profile/:userId', authenticate, apiController.getProfile);
app.get('/api/page/:pageId', authenticate, apiController.getPage);
app.put('/api/:contentId/like', authenticate, apiController.likeContent);
app.listen(3000);
We can simply apply the authentication handler once on a wildcard route:
app.all('/api/*', authenticate);
// the above route will be called before of any of the below routes matching /api/*
// therefore, we don't need to explicitly chain it on each route.
app.get('/api/users', apiController.getUsers);
app.get('/api/profile/:userId', apiController.getProfile);
app.get('/api/page/:pageId', apiController.getPage);
app.put('/api/:contentId/like', apiController.likeContent);
This reduces chaining on individual routes, and may improve security since there is less likelihood of a developer forgetting to add important security middleware on certain routes.
This middleware is largely inspired by koa-router. The reason for building a new router is that they explicitly decided not to allow the route chaining behavior outlined above.
More documentation and features will be coming soon... this is a work in progress.
FAQs
A koa router which supports chained route matching.
We found that koa-trail demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.