
Research
Malicious npm Packages Impersonate Flashbots SDKs, Targeting Ethereum Wallet Credentials
Four npm packages disguised as cryptographic tools steal developer credentials and send them to attacker-controlled Telegram infrastructure.
Kralo is a framework using a NodeJS/MongoDB + Mongoose/Socket.IO/Redis stack.
Get the source from GitHub or install via NPM
npm install kralo --save
Note: this will take a while. We include all the dependencies to run this.
0.5.0
In a web.js file at your project root, use the following to set up a kralo server:
var nm = require('kralo');
var config = {
appName: 'ExampleApp',
server: 'Main',
port: process.argv[2] || 4050,
useStaticServer: true,
favicon: 'favicon.ico',
envLocation: '_env.js',
preContent: 'routes.js',
postContent: 'routes2.js',
mongooseSchemaLocation: '_schema.js',
viewEngine: 'jade',
viewDirectory: 'views',
publicDirectory: 'public',
servers: ['Main:' + os.hostname()],
logger: {
userName: '',
password: ''
},
api: {
location: 'api'
},
onlineUsersConfig: {
timer:900
}
};
nm.extra(__dirname).server(config);
Each option should be customized for your app.
Allows you to set environment variables used throughout the app:
exports.configureEnvironment = function(app, process) {
// required variables
process.env['SESSION_KEY'] = 'my_express.sid';
process.env['SESSION_SECRET'] = 'exampleSecret';
process.env['COOKIE_KEY'] = 'ExampleCookie';
process.env.MONGO_URI = '';
process.env.REDIS_URI = 'redis://redis:redis@ip:port/dbindex';
// add your own
process.env['SOME_API_KEY'] = 'aaa111nnn123';
};
Allows you to create custom routes for your app.
exports.content = function(app, io) {
// you can use this page for additional, custom routes
app.get('/', function(req, res, next) {
res.send('This is an example server');
});
};
Allows you to create APIs that can be accessed by both socket.io and by RESTful requests.
Say I want to call the function 'run' under 'SomeAPI'. I can request the API either using http://localhost:4050/api/SomeAPI/run
or by using sockets on the client:
socket.emit('api', 'SomeAPI', 'run', {
testData: 'I Am Groot'
}, function(err, data) {
if (err) {
console.log(err);
} else {
console.log(data);
}
});
The contents of api/SomeAPI.js
then look like:
exports.run = function() {
console.log(data.testData); // prints "I Am Groot"
var number = Math.random();
if (number < .5) {
return fn('This is a standard error message.');
} else {
return fn(null, {
data: 'This the standard way to send data back to the client.'
});
}
};
Extras has the following properties:
mongoose
- access to the mongoose variable.io
socket
- the particular socket connection, if availableconnectionType
- either socket or http.fileName
- the file that the API is being hit by.req
- if availableres
- if availablemethod
- the method that is being called.ipAddress
hostname
function testSession(data,fn,session,extras,next){
if(!session){
return fn("You have to have a session for this.");
} else {
return next();
}
}
exports.testSession=API2(testSession,testSession,function(data,fn,session,extras){
fn(null, 'You have a session!');
});
exports.fn=function(){
fn(null, 'yay!!');
};
exports.staticVariacle=1;
Next allows you to run the next functon in the iteration. If you want to skip all middleware except the last function, run next({ finish: true }).
Also, if you use the middleware and do not provide a connectionType in extras, API2 will add 'internal' to the connectionType.
If you want to run an API after another API is complete, you may add an after() call to the middleware.
var middleware = API('middleware');
var afterware = API('afterware');
exports.run = API2(middleware.checkCredentials, function(data, fn, session, extras) {
if (!data) {
return fn('You did not send any data.');
}
var number = Math.random();
console.log('We are sending back this number::', number);
return fn(null, number);
});
exports.run.after(afterware.testLog);
In the above example, the run()
API will use middleware to check access credentials. If the credentials middleware finishes successfully, our API does its work. As soon as fn(null, number)
is called, the afterware API called eventLog
is triggered. What happens inside the afterware API has no impact on what the run()
API does. An afterware API gets the parameters err, res, data, session, extras
, and might look something like:
exports.testLog = function(err, res, data, session, extras) {
if (err) {
return console.log('The API experienced an error. Log the error to the DB.')
} else {
return console.log('We can log the number ' + res + ' to the DB.');
}
};
With 0.5.0 we are introducing promises for our APIs. To turn any of our APIs as a promise, run API.Q. Although it should be compatible with several promise libraries, I recommend using the module, q.
var User = API.Q('User');
User.getData({},'session','extras').then(function(){
console.log('success',arguments);
},function(){
console.log('fail',arguments);
});
Allows you to create a mongoose schema that can be used throughout your app. Configure your file to look like this:
var mongoose = require('mongoose');
var Schema = mongoose.Schema;
exports.User = mongoose.model('User', new Schema({
firstName: String,
lastName: String,
fullName: String
}));
Note: everything you export in here will be attached to the global scope. It will be accessible throughout your whole server.
FAQs
A configured server for node
The npm package kralo receives a total of 0 weekly downloads. As such, kralo popularity was classified as not popular.
We found that kralo demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Four npm packages disguised as cryptographic tools steal developer credentials and send them to attacker-controlled Telegram infrastructure.
Security News
Ruby maintainers from Bundler and rbenv teams are building rv to bring Python uv's speed and unified tooling approach to Ruby development.
Security News
Following last week’s supply chain attack, Nx published findings on the GitHub Actions exploit and moved npm publishing to Trusted Publishers.