
Security News
The Hidden Blast Radius of the Axios Compromise
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.
轻量级微服务基础框架,提供各服务通用的基础功能和标准组件。
mcore.js/
├── src/ # 源代码目录
│ ├── app/ # 应用核心
│ ├── auth/ # 认证模块
│ ├── cache/ # 缓存系统
│ ├── config/ # 配置管理
│ ├── db/ # 数据库集成
│ ├── hooks/ # 钩子系统
│ ├── logging/ # 日志系统
│ ├── middlewares/ # 中间件
│ ├── monitor/ # 监控系统
│ ├── mq/ # 消息队列
│ ├── registry/ # 服务注册
│ ├── resilience/ # 弹性机制
│ ├── router/ # 路由系统
│ ├── security/ # 安全模块
│ └── utils/ # 工具函数
├── examples/ # 示例代码
├── docs/ # 文档
└── tests/ # 测试文件
npm install mcore.js
const { createApp } = require('mcore.js');
// 创建应用实例
const app = createApp({
name: 'my-app',
port: 3000
});
// 启动应用
app.start();
const { createApp } = require('mcore.js');
// 创建应用实例
const app = createApp({
name: 'my-app',
port: 3000,
// 中间件配置
middleware: {
errorHandler: {
enabled: true,
options: {
showStack: process.env.NODE_ENV === 'development'
}
},
requestLogger: {
enabled: true,
options: {
level: 'info'
}
}
},
// 生命周期配置
lifecycle: {
shutdownTimeout: 5000,
gracefulShutdown: true
}
});
// 注册路由
app.loadRoutes('routes');
// 注册生命周期钩子
app.on('beforeStart', async ({ app }) => {
// 初始化数据库连接等
});
app.on('afterStart', async ({ app }) => {
// 启动后的工作
});
// 启动应用
app.start();
const app = createApp({
name: 'lifecycle-demo',
port: 3000,
lifecycle: {
shutdownTimeout: 5000,
gracefulShutdown: true
}
});
// 生命周期钩子
app.on('beforeStart', async ({ app }) => {
// 初始化工作
});
app.on('afterStart', async ({ app }) => {
// 启动后工作
});
app.on('beforeStop', async ({ app }) => {
// 清理工作
});
// 应用控制
await app.start();
await app.stop();
await app.restart();
// 获取应用状态
const status = app.getStatus();
const app = createApp({
middleware: {
// 错误处理中间件
errorHandler: {
enabled: true,
options: {
showStack: process.env.NODE_ENV === 'development'
}
},
// 请求日志中间件
requestLogger: {
enabled: true,
options: {
level: 'info'
}
},
// 安全中间件
security: {
enabled: true,
options: {
cors: true,
helmet: true,
xss: true
}
}
}
});
// 注册自定义中间件
app.registerMiddleware('customLogger', {
factory: (options) => async (ctx, next) => {
console.log(`[${new Date().toISOString()}] ${ctx.method} ${ctx.url}`);
await next();
},
config: {
enabled: true,
options: {}
}
});
// 配置中间件
app.configureMiddleware('requestLogger', {
enabled: true,
options: {
level: 'debug'
}
});
// 自动加载路由
app.loadRoutes('routes', {
recursive: true,
fileExtensions: ['.js'],
excludePatterns: [/\.test\.js$/]
});
// 路由文件示例 (routes/users.js)
module.exports = {
prefix: '/api/users',
middlewares: [
async (ctx, next) => {
console.log('用户API访问');
await next();
}
],
routes: {
'/': {
get: async (ctx) => {
ctx.body = { users: [] };
},
post: async (ctx) => {
ctx.body = { message: '创建成功' };
}
},
'/:id': {
get: async (ctx) => {
ctx.body = { id: ctx.params.id };
}
}
}
};
// 使用内置错误处理
app.configureMiddleware('errorHandler', {
enabled: true,
options: {
showStack: process.env.NODE_ENV === 'development',
includeRequestInfo: true
}
});
// 自定义错误处理
app.on('error', async (err, ctx) => {
// 自定义错误处理逻辑
console.error('应用错误:', err);
});
my-app/
├── src/
│ ├── routes/ # 路由文件
│ ├── controllers/ # 控制器
│ ├── services/ # 业务逻辑
│ ├── models/ # 数据模型
│ ├── middlewares/ # 自定义中间件
│ └── utils/ # 工具函数
├── config/ # 配置文件
├── tests/ # 测试文件
└── app.js # 应用入口
// config/index.js
module.exports = {
development: {
port: 3000,
database: {
url: 'mongodb://localhost:27017/dev'
}
},
production: {
port: process.env.PORT,
database: {
url: process.env.DATABASE_URL
}
}
}[process.env.NODE_ENV || 'development'];
// utils/errors.js
class AppError extends Error {
constructor(code, message, status = 500) {
super(message);
this.code = code;
this.status = status;
}
}
// 使用示例
throw new AppError('USER_NOT_FOUND', '用户不存在', 404);
// 配置日志中间件
app.configureMiddleware('requestLogger', {
enabled: true,
options: {
level: 'info',
format: 'combined'
}
});
// 使用日志
app.logger.info('应用启动');
app.logger.error('发生错误', { error: err });
git checkout -b feature/AmazingFeature)git commit -m 'Add some AmazingFeature')git push origin feature/AmazingFeature)ISC
FAQs
MCore.js - 轻量级微服务基础框架
We found that mcore.js demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.