Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
使用本服务请手动联系管理员开通服务权限。
发送邮件到 fe.node@ele.me 申请 id, 如:
// 邮件内容
{
// 基本字段
appName: "test_dal", // 应用名称,必须提供,用于生成具体 dbName 的帐户权限
// 默认细节配置
mongoDalPort: 30017, // MongoDAL 守护进程启动端口
rPoolSize: 1, // 读连接池大小
wPoolSize: 1, // 写连接池大小
reqLimit: 100, // 请求并发数阈值
rConnLimit: 100, // 读连接最大阈值
wConnLimit: 50, // 写连接最大阈值
connTimeout: 60, // 连接超时时间,单位秒
slowMs: 2000, // 慢查询时间
// 若有提供了自己的数据库, 请提供以下字段
mongoAddr: "127.0.0.1:20000", // 线上 mongodb 地址
dbName: "test_dal", // 数据库名
user: "test_dal.fFke06C+", // 用户名
pwd: "pyEajKYs", // 密码
}
申请通过邮件会回复申请的 id 信息。
npm install mgodd --save
mongoose 版本 demo,(alpha 环境请强制开启 debug 模式,生产环境请关闭 debug,默认关闭):
const mgodd = require('mgodd');
const mongoose = require('mongoose');
// schema
const Cats = require('./cats');
(async() =>{
try {
// 启动 MongoDAL 守护进程
await mgodd({
id: '599feed49f853960606db7b4', // [required] 申请的 id
output: 'mongo-dal.log', // [optional] 日志输出路径,默认当前目录的 mongo-dal.log
debug: false, // [optional] alpha 环境请强制开启 debug 模式,否则起不起来,生产环境请关闭 debug,默认关闭
env: 'alpha', // [optional] 可选值为 [alpha, alta, altb, prod] faas-now 环境下可以自动判断环境,eless 环境下请手动指定
statsdUrl: 'statsd.alpha.elenet.me:8125', // [optional] 默认从机器的 ELE_STATSD_URL 环境变量读取,可以手动指定
});
mongoose.Promise = Promise;
// 连接到 MongoDAL 上
await mongoose.connect('mongodb://localhost:30017/test_dal', {
useMongoClient: true,
reconnectTries: Number.MAX_VALUE,
reconnectInterval: 1000
});
mongoose.connection.on('error', console.error);
// setInterval(async () => {
// try {
// let res = await Cats.find({})
// console.log(Date.now(), res)
// } catch(err) {
// console.error(err)
// }
// }, 2000)
} catch(err) {
console.error("global error: ", err);
}
})()
mongodb 版本 demo,(alpha 环境请强制开启 debug 模式,生产环境请关闭 debug,默认关闭):
const mgodd = require('mgodd');
const MongoClient = require('mongodb').MongoClient;
(async () => {
try {
// 启动 MongoDAL 守护进程
await mgodd({
id: '599feed49f853960606db7b4', // [required] 申请的 id
output: 'mongo-dal.log', // [optional] 日志输出路径,默认当前目录的 mongo-dal.log
debug: false, // [optional] 是否开启 debug 模式,mac 环境默认开启 debug 模式
env: 'alpha', // [optional] 可选值为 [alpha, alta, altb, prod] faas-now 环境下可以自动判断环境,eless 环境下请手动指定
statsdUrl: 'statsd.alpha.elenet.me:8125', // [optional] 默认从机器的 ELE_STATSD_URL 环境变量读取,可以手动指定
});
// 连接到 MongoDAL 上
let db = await MongoClient.connect('mongodb://localhost:30017/test_dal');
let coll = db.collection('cats');
await coll.insert({name: 'cat1'});
let res = await coll.find({}).toArray();
console.log(res);
} catch(err) {
console.error("global error: ", err);
}
})()
FAQs
mongo dal daemon
The npm package mgodd receives a total of 1 weekly downloads. As such, mgodd popularity was classified as not popular.
We found that mgodd demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.