
Security News
/Research
Wallet-Draining npm Package Impersonates Nodemailer to Hijack Crypto Transactions
Malicious npm package impersonates Nodemailer and drains wallets by hijacking crypto transactions across multiple blockchains.
meetup-web-platform
Advanced tools
A collection of Node web application utilities developed for the Meetup web platform
This is the base platform for serving Meetup web apps including the public website and admin. It provides a Hapi webserver and a set of conventions for composing applications with React + Redux.
In general, application-specific code will live outside of this package.
requestAuthPlugin
This package uses semver versioning to tag releases, although the patch version
is determined exclusively by the Travis build number for pushes to master
.
Major and minor versions are hard-coded into the Makefile.
Manual pushes to master
and PR merges to master will be built by Travis, and
will kick off the yarn publish routine. The currently-published version of the
package is shown on the repo homepage on GitHub in a badge at the top of the
README.
When developing a consumer application that requires changes to the platform code, you can release a beta version of the platform on npm by opening a PR in the meetup-web-platform repo. When it builds successfully, a new beta version will be added to the list of available npm versions. The generated version number is in the Travis build logs, which you can navigate to by clicking on 'Show all checks' in the box that says 'All checks have passed', and then getting the 'Details' of the Travis build.
At the bottom of the build log, there is a line that echo
s the GIT_TAG
.
If you click the disclosure arrow, the version number will be displayed, e.g.
0.5.177-beta
.
You can then install this beta version into your consumer application with
> yarn install meetup-web-platform@<version tag>
Each time you push a change to your meetup-web-platform
PR, you'll need to
re-install it with the new tag in your consumer application code.
The overall workflow is:
meetup-web-platform
branchGIT_TAG
meetup-web-platform
branchBasic knowledge of reactive programming using RxJS 5 is a pre-requisite for being able to work in this repository. https://www.learnrxjs.io/ manages a good list of starting resources, specifically:
Suggestions:
console.log
to each transformation step, etc).The server module exports a startServer
function that consumes
a mapping of locale codes to app-rendering Observables, plus any app-specific
server routes and plugins. See the code comments for usage details.
<NotFound>
To correctly render a 'not found' state for a feature, you should render a
<NotFound>
component, which the server will use to set the response status to
404.
import NotFound from 'meetup-web-platform/lib/components/NotFound';
class GroupContainer extends React.Component {
render() {
if (!this.props.group) {
return (
<NotFound>
<h1>Sorry, no matching group was found</h1>
</NotFound>
);
}
return <GroupDetail group={this.props.group} />;
}
}
Activity tracking happens on every HTTP request, and is tagged with
platform: 'WEB',
platform_agent: <read from package.json:config.agent>
The platform also tracks clicks similar to Meetup classic.
More info in Confluence here
Use Promises or Observables to handle async processing - the latter tends to provide more powerful async tools than the former, particularly for long processing chains or anything involving sequences of values, but Promises are good for single async operations. Do not write functions that fire callbacks.
When using Observables, you can always throw
an Error and expect the
subscriber to provide an onError
handler. When using Promises, call
Promise.reject(new Error(<message>))
and expect that the caller will
provide a .catch()
or onRejected
handler.
Guidelines:
Error
objects liberally - they are totally safe until they are
paired with a throw
, and even then they can be usefully
processed without crashing the application with a try/catch
.throw
when there is no clear way for the application to recover from
the error. Uncaught errors are allowed to crash the application and
are valuable both in dev and in integration tests.Error
object rather than just a
Boolean or error message String. Error objects provide better
introspection data. For example, a validation process might return
null
(for no validation errors) or new Error('Value is required')
rather than true
(for "is valid") or false
.LOGIN_ERROR
- keep the corresponding state updates
as narrow as possible. For example, LOGIN_ERROR
should only affect
state.app.login
- all affected UI components should read from that
property rather than independently responding to LOGIN_ERROR
in a
reducer. Do not create a high-level error
properties statecatch
for Promises, error
for
Observables)FAQs
A collection of Node web application utilities developed for the Meetup web platform
The npm package meetup-web-platform receives a total of 50 weekly downloads. As such, meetup-web-platform popularity was classified as not popular.
We found that meetup-web-platform demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
/Research
Malicious npm package impersonates Nodemailer and drains wallets by hijacking crypto transactions across multiple blockchains.
Security News
This episode explores the hard problem of reachability analysis, from static analysis limits to handling dynamic languages and massive dependency trees.
Security News
/Research
Malicious Nx npm versions stole secrets and wallet info using AI CLI tools; Socket’s AI scanner detected the supply chain attack and flagged the malware.