Research
Security News
Threat Actor Exposes Playbook for Exploiting npm to Build Blockchain-Powered Botnets
A threat actor's playbook for exploiting the npm ecosystem was exposed on the dark web, detailing how to build a blockchain-powered botnet.
NodeJS Contextual Dependency Injection using native async_hooks
see https://stackabuse.com/using-async-hooks-for-request-context-handling-in-node-js/ and https://nodejs.org/api/async_hooks.html
yarn add nctx
or
npm i nctx
ctx/app.js
const nctx = require("nctx")
module.exports = nctx.create(Symbol("app"))
ctx/req.js
const nctx = require("nctx")
const reqCtx = nctx.create(Symbol("req"))
reqCtx.createAppMiddleware = () => {
return (req, res, next) => {
reqCtx.provide()
reqCtx.share(req)
res.on("finish", () => {
reqCtx.endShare(req)
})
reqCtx.set("req", req)
next()
}
}
reqCtx.createRouterMiddleware = () => {
return function (req, _res, next) {
reqCtx.share(req)
if (next) {
next()
}
}
}
module.exports = reqCtx
app.js
const express = require("express")
const reqCtx = require("~/ctx/req")
const app = express()
app.use(reqCtx.createAppMiddleware())
// middlewares context
app.use(async (req, _res, next) => {
const reqLogger = logger.child({ path: req.path })
reqCtx.set("logger", reqLogger)
next()
})
const router = express.Router()
router.use(reqCtx.createRouterMiddleware())
app.use(router)
// now you can get contextual logger from anywhere you call reqCtx under async tree
router.get("/", async ()=>{
const reqLogger = reqCtx.get("logger")
// the reqLogger is specific to the query
})
const nctx = require("nctx")
const funcCtx1 = nctx.create()
const func = async () => {
const foo = funcCtx1.require("foo")
return `foo=${foo}`
}
const main = async () => {
funcCtx1.provide()
funcCtx1.set("foo", "bar")
const result = await Promise.all([
nctx.fork(() => {
funcCtx1.set("foo", "jo")
// here func is executed under the forked context 1
return func()
}, [funcCtx1]),
nctx.fork(() => {
funcCtx1.set("foo", "devthejo")
// here func is executed under the forked context 2
return func()
}, [funcCtx1]),
// here func is executed under original context
func(),
])
console.log(result)
}
main()
FAQs
NodeJS Contextual Dependency Injection using native async_hooks - IoC
The npm package nctx receives a total of 67 weekly downloads. As such, nctx popularity was classified as not popular.
We found that nctx demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A threat actor's playbook for exploiting the npm ecosystem was exposed on the dark web, detailing how to build a blockchain-powered botnet.
Security News
NVD’s backlog surpasses 20,000 CVEs as analysis slows and NIST announces new system updates to address ongoing delays.
Security News
Research
A malicious npm package disguised as a WhatsApp client is exploiting authentication flows with a remote kill switch to exfiltrate data and destroy files.