
Research
SANDWORM_MODE: Shai-Hulud-Style npm Worm Hijacks CI Workflows and Poisons AI Toolchains
An emerging npm supply chain attack that infects repos, steals CI secrets, and targets developer AI toolchains for further compromise.
mongoose-hook
Advanced tools
Abstract mongoose plugin, allowing usage of 'pre' and 'post' hooks on internal direct wrappers to database API for all (including static) mongoose operations.
Abstract mongoose plugin, allowing usage of 'pre' and 'post' hooks on internal direct wrappers to database API for all (including static) mongoose operations.
git clone git@github.com:tarquas/mongoose-hook.git mongoose-hook
{
"mongoose-hook": "tarquas/mongoose-hook#40df5bac52"
}
Example: A plugin to mark every new document with some watermark (uses pre 'insert' hook):
mongoose-watermark.js
'use strict';
var
hookPlugin = require('./mongoose-hook'),
thisPlugin = {};
thisPlugin.pre = function(p, callback) {
if (p.insert) {
p.insert[this.watermarkPath] = this.watermarkValue;
}
callback();
};
module.exports = function(schema, opts) {
schema.plugin(hookPlugin, {
mongoose: opts.mongoose,
pre: thisPlugin.pre,
watermarkPath: opts.path || 'watermark',
watermarkValue: opts.value
});
};
Usage of plugin: adds a field to every new document, specifying which process ID created it:
watermark-example.js
var
mongoose = require('mongoose'),
watermarkPlugin = require('./mongoose-watermark');
mongoose.plugin(watermarkPlugin, {
mongoose: mongoose,
path: 'createdByProcess',
value: process.pid
});
Hook plugin must be provided with an exact instance of mongoose, where the processing models expected to be processed in opts parameter. The plugin correctly handles the hooking on multiple mongoose instances.
Comparing the code above with the following:
schema.post('save', function(next) {
this.createdByProcess = process.pid;
next();
});
The difference is that post 'save' hook is not called for Model.create(...) method; the post 'insert' hook is called in either case, because mongoose calls underlying insert wrapper of database API anyway. Also, in example above p.insert may also refer to $setOnInsert object on upsert operation.
this object, which is passed to hook function is an instance of mongoose.Collection. Please, refer to mongoose manuals for its API. Also, this plugin adds getModel() method to mongoose.Collection prototype, which returns a Model (made by mongoose.model()), which refers to given mongoose.Collection instance.FAQs
Abstract mongoose plugin, allowing usage of 'pre' and 'post' hooks on internal direct wrappers to database API for all (including static) mongoose operations.
We found that mongoose-hook demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
An emerging npm supply chain attack that infects repos, steals CI secrets, and targets developer AI toolchains for further compromise.

Company News
Socket is proud to join the OpenJS Foundation as a Silver Member, deepening our commitment to the long-term health and security of the JavaScript ecosystem.

Security News
npm now links to Socket's security analysis on every package page. Here's what you'll find when you click through.