
Research
Malicious npm Packages Impersonate Flashbots SDKs, Targeting Ethereum Wallet Credentials
Four npm packages disguised as cryptographic tools steal developer credentials and send them to attacker-controlled Telegram infrastructure.
$ npm install lured
scripts
is an object in with the following structure:var scripts = {
foo: {
script: "return 1", // your lua script for 'foo'
sha: "e0e1f9fabfc9d4800c877a703b823ac0578ff8db" // filled by lured
},
bar: {
script: "return 2", // your lua script for 'bar'
sha: "7f923f79fe76194c868d7e1d0820de36700eb649" // filled by lured
}
};
Where, sha
properties are automatically filled by lured.
var fs = require('fs')
var scripts = {
foo: {
script: fs.readFileSync(__dirname + '/foo.lua', {encoding:'utf8'})
},
bar: {
script: fs.readFileSync(__dirname + '/bar.lua', {encoding:'utf8'})
}
};
var client = require('redis').createClient();
var lured = require('lured').create(client, scripts);
// Load all scripts on to redis server.
lured.load(function (err) {
if (err) { /* handler error */}
else {
// Do your cool stuff here
// Now you can safely do something like this:
client.multi()
.evalsha(scripts.foo.sha, 0)
.evalsha(scripts.bar.sha, 0)
.exec(function(err, replies) {
// Check your replies.
});
}
});
When redis client emits 'connect' event, lured will check if the scripts are still cached, if not it will reload the scripts for you. If you need to track down the underlying behavior, set a listener on 'state' event.
Script loading and management is pain. So, looked for a good tool. I wanted to use SHA values so that I can use MULTI with mixture of the scripts and other commands, but the tools I came across hide many good stuff including the SHA values, and here comes the lured
!
FAQs
Lua script loading tool for Redis.
The npm package lured receives a total of 209 weekly downloads. As such, lured popularity was classified as not popular.
We found that lured demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Four npm packages disguised as cryptographic tools steal developer credentials and send them to attacker-controlled Telegram infrastructure.
Security News
Ruby maintainers from Bundler and rbenv teams are building rv to bring Python uv's speed and unified tooling approach to Ruby development.
Security News
Following last week’s supply chain attack, Nx published findings on the GitHub Actions exploit and moved npm publishing to Trusted Publishers.