
Research
PyPI Package Disguised as Instagram Growth Tool Harvests User Credentials
A deceptive PyPI package posing as an Instagram growth tool collects user credentials and sends them to third-party bot services.
mongoose-hook
Advanced tools
Abstract mongoose plugin, allowing usage of 'pre' and 'post' hooks on internal direct wrappers to database API for all (including static) mongoose operations.
Abstract mongoose plugin, allowing usage of 'pre' and 'post' hooks on internal direct wrappers to database API for all (including static) mongoose operations.
git clone git@github.com:tarquas/mongoose-hook.git mongoose-hook
{
"mongoose-hook": "tarquas/mongoose-hook#40df5bac52"
}
Example: A plugin to mark every new document with some watermark (uses pre 'insert' hook):
mongoose-watermark.js
'use strict';
var
hookPlugin = require('./mongoose-hook'),
thisPlugin = {};
thisPlugin.pre = function(p, callback) {
if (p.insert) {
p.insert[this.watermarkPath] = this.watermarkValue;
}
callback();
};
module.exports = function(schema, opts) {
schema.plugin(hookPlugin, {
mongoose: opts.mongoose,
pre: thisPlugin.pre,
watermarkPath: opts.path || 'watermark',
watermarkValue: opts.value
});
};
Usage of plugin: adds a field to every new document, specifying which process ID created it:
watermark-example.js
var
mongoose = require('mongoose'),
watermarkPlugin = require('./mongoose-watermark');
mongoose.plugin(watermarkPlugin, {
mongoose: mongoose,
path: 'createdByProcess',
value: process.pid
});
Hook plugin must be provided with an exact instance of mongoose
, where the processing models expected to be processed in opts
parameter. The plugin correctly handles the hooking on multiple mongoose
instances.
Comparing the code above with the following:
schema.post('save', function(next) {
this.createdByProcess = process.pid;
next();
});
The difference is that post 'save' hook is not called for Model.create(...)
method; the post 'insert' hook is called in either case, because mongoose calls underlying insert
wrapper of database API anyway. Also, in example above p.insert
may also refer to $setOnInsert
object on upsert operation.
this
object, which is passed to hook function is an instance of mongoose.Collection
. Please, refer to mongoose
manuals for its API. Also, this plugin adds getModel()
method to mongoose.Collection
prototype, which returns a Model
(made by mongoose.model()
), which refers to given mongoose.Collection
instance.FAQs
Abstract mongoose plugin, allowing usage of 'pre' and 'post' hooks on internal direct wrappers to database API for all (including static) mongoose operations.
The npm package mongoose-hook receives a total of 528 weekly downloads. As such, mongoose-hook popularity was classified as not popular.
We found that mongoose-hook demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
A deceptive PyPI package posing as an Instagram growth tool collects user credentials and sends them to third-party bot services.
Product
Socket now supports pylock.toml, enabling secure, reproducible Python builds with advanced scanning and full alignment with PEP 751's new standard.
Security News
Research
Socket uncovered two npm packages that register hidden HTTP endpoints to delete all files on command.