Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Flow: Track asynchronous application flow and access flow context variables
This library allows you to create custom asynchronous flow contexts and access its variables in every step of the flow execution.
Let's illustrate Flow functionality on a simple http server:
const Flow = require('liqd-flow'); // load Flow library
let requestID = 0;
const server = require('http').createServer( ( req, res ) =>
{
// Start a new flow in request handler
Flow.start( () =>
{
dispatch( req.url ).then( result => res.end( result ));
},
// and set its variables
{
start: process.hrtime(),
requestID: ++requestID
});
})
.listen(8080);
async function dispatch( url )
{
Flow.set( 'url', url ); // Set a new variable in our Flow
let data = await Model.getData( url );
return
{
data,
elapsed: process.hrtime( Flow.get( 'start' ) ), // get process.hrtime() from the current Flow (server request handler)
requestID: Flow.get( 'requestID' ) // get requestID incremented in the current Flow (server request handler)
};
}
npm install --save liqd-flow
Starts a new Flow and sets its scope object.
callback
{Function} Callback executed in a newly created Flowscope
{Object} Scope assigned to the Flow
{}
freeze
{Boolean} If set to true scope variables are frozen to prevent changes in the Flow
true
Flow.start( () =>
{
// Callback is executed inside Flow scope
let foo = Flow.get('foo'); // returns 'bar';
},
{ foo: 'bar' }); // Sets the Flow scope
Sets value for the key in the current Flow if key is not frozen.
key
{Any} Keyvalue
{Any} Valuefreeze
{Boolean} If set to true value for key will be frozen to prevent changes in the Flow
true
Returns {Boolean}
true
value has been set for the key which was not frozenfalse
key was frozen and variable have not been changedFlow.set('foo', 'bar', false); // Sets the value inside Flow, returns true
Flow.set('foo', 'boo', true); // Rewrites the value, returns true
Flow.set('foo', 'goo'); // Does not rewrite the value, returns false
Returns value for the key in the current Flow, default_value
if the key is not set.
key
{Any} Keydefault_value
{Any} Value returned if the key is not set
undefined
Returns {Any}
let foo = Flow.get('foo');
Returns value for the path in the current Flow, default_value
if the path is not set.
path
{Array of Strings | String} pathdefault_value
{Any} Value returned if the key is not set
undefined
path_delimiter
{String} Path delimiter if path is {String}
'.'
Returns {Any}
let foo = Flow.getPath('obj.foo');
let bar = Flow.getPath('obj|bar', null, '|');
Returns the current scope of the Flow, object containing every key set in the Flow with its value and frozen state.
Returns {Object}
let scope = Flow.scope();
/* scope =
{
[key] : { value, frozen }
}
*/
Returns the current Flow handle for later restoration.
Returns {FlowHandle}
let flow_handle = Flow.save();
Restores the stored Flow and dispatches the callback. Flow can be restored by calling restore method on FlowHandle as well. Each FlowHandle can be restored only once - multiple restorations throws an Exception.
Flow.restore( flow_handle, () =>
{
// Flow is restored
});
flow_handle.restore( () =>
{
// Flow is restored
});
Binds the current Flow to callback function, callback can be executed outside of current flow yet the original Flow is automaticaly restored.
let callback;
Flow.start( () =>
{
callback = Flow.bind( () =>
{
let foo = Flow.get('foo'); // returns 'bar'
});
},
{ foo: 'bar' });
setTimeout( callback, 1000 ); // Executes callback outside of its Flow
FAQs
Flow: Track asynchronous application flow and access flow context variables
The npm package liqd-flow receives a total of 1 weekly downloads. As such, liqd-flow popularity was classified as not popular.
We found that liqd-flow demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.