
Research
Malicious npm Packages Impersonate Flashbots SDKs, Targeting Ethereum Wallet Credentials
Four npm packages disguised as cryptographic tools steal developer credentials and send them to attacker-controlled Telegram infrastructure.
mozilla-ping-centre
Advanced tools
A client for easily collecting events and metrics.
$ npm install ping-centre
const PingCentre = require("ping-centre");
// create a ping-centre object
const pc = new PingCentre("some_topic_foo", "some_cient_id_123");
// create the payload
const payload = makePayload();
// send the payload asynchronously
pc.sendPing(payload);
// validate the payload asynchronously
pc.validate(payload);
When testing your app with Ping Centre, your data will be sent to a staging server by default.
To send your data to a production server, set the NODE_ENV
environment variable to production
.
Ping-centre consists of three main parts: the clients, the data pipeline, and the dashboard.
The clients are responsible for collecting the events and forwarding them to Onyx - the entrance of the data pipeline. Besides Onyx, the data pipeline employes a Disco cluster to run the ETL jobs, which in turn persist the outcome to AWS Redshift. Through re:dash dashboard, the user can access the data warehouse, slice and dice the datasets via SQL queries.
Behind the scenes, a ping-centre client is simply a wrapper around the HTTP POST request. Therefore, it could be implemented in any programming language. And this repo implements it in Javascript.
As ease-of-use is the primary goal of the client, the client user does not need to specify the telemetry destination, i.e. the endpoint of the Onyx. Instead, the user just specifies the topic of the payload. In fact, Onyx merely exposes a single endpoint and multiplexes all the topics onto that endpoint. The ETL task runner Infernyx will demultiplex the inputs and process each topic separately.
For each topic, the user is going to provide a schema to describe the associated payload. As the reference of table schema in Redshift, this schema could also be used by the ETL jobs to conduct the data extraction, cleaning, and transforming.
We use joi-browser to define the schemas for the Javascript client. By convention, all
schemas are saved in the schemas
directory with the same name of the topics. In each schema,
the user specifies following attributes in the schema for each topic:
Here is an example:
const Joi = require("joi-browser");
const schema = Joi.object().keys({
// a required string field with no more than 128 characters
client_id: Joi.string().max(128).required(),
// a required javascript timestamp with milliseconds
received_at: Joi.date().timestamp().required(),
// an required enum string field
event: Joi.any().valid(['add', 'delete', 'search']).required(),
// an optional positive integer field
value: Joi.number().integer().positive().optional(),
}).options({allowUnknown: true}); // allow other non-specified fields
/*
* ETL processing
*
* 1. Truncate the milliseconds of the 'received_at', e.g. 147743323232 -> 147743323
* 2. Rename the 'value' field to 'latency' in the database
* 3. Capitalize the 'event' field
*/
module.exports = schema;
FAQs
A client for easily collecting events and metrics.
The npm package mozilla-ping-centre receives a total of 2 weekly downloads. As such, mozilla-ping-centre popularity was classified as not popular.
We found that mozilla-ping-centre demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Four npm packages disguised as cryptographic tools steal developer credentials and send them to attacker-controlled Telegram infrastructure.
Security News
Ruby maintainers from Bundler and rbenv teams are building rv to bring Python uv's speed and unified tooling approach to Ruby development.
Security News
Following last week’s supply chain attack, Nx published findings on the GitHub Actions exploit and moved npm publishing to Trusted Publishers.