
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
MeDB is a pluggable data loader for InfluxDB, intended for use as the basis for a customisable personal analytics system.
The idea is that all the heavy lifting should fall to established platforms. Influx is a powerful time-series database with a number of great integrations, including the excellent Grafana for visualisation. The only role remaining for MeDB is to determine what data to collect and how to collect it.
npm install -g medbnpm install -g medb-whatever~/medb.json An example is in the repo.medbPlugins each get their own top-level key in the configuration JSON. The presence of that key tells MeDB to load the relevant plugin, for example "github": {} tells it to look for a module called medb-github. Any data under the key is passed to that plugin. The medb key is a special case, and contains data needed for medb to connect to your local influxdb instance.
Plugins are loaded via requireg, which will look in both local and global node_modules directories. That means you have a lot of flexibility with where to put plugins, including installing them with npm install -g, locally installing them inside medb, or placing them in node_modules under your home directory.
This is pretty early stage stuff, so don't expect an out-of-the-box experience. If you want to use it, you will probably need to write your own plugins or send pull requests for existing ones to make them cover your needs. Feel free to do this! I'd be happy to see the platform evolve. Ideally, working with MeDB should still be easier than rolling your own thing from scratch, even if it's currently a bit green.
FAQs
Pluggable InfluxDB loader for personal data analytics
The npm package medb receives a total of 2 weekly downloads. As such, medb popularity was classified as not popular.
We found that medb demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.