
Research
PyPI Package Disguised as Instagram Growth Tool Harvests User Credentials
A deceptive PyPI package posing as an Instagram growth tool collects user credentials and sends them to third-party bot services.
The purpose with this module is to share contexts across async (and sync) calls. Contexts are accessed by keys and can be nested. It is an alternative to the deprecated domain. It is based on async_hooks that were introduced in node 8. Beware that that the async_hooks are still experimental in nodejs.
To avoid weird behavior with express
node-cls
in the first row of your app. Some popular packages use async which breaks CLS.body-parser
and context is getting lost, register it in express before you register node-cls
's middleware.Request handler
A typical scenario is when you need to share context in a request handler.
let http = require('http');
let cls = require('node-cls');
let server = http.createServer(function (request, response) {
let context = cls.create('request-context');
context.id = 1;
context.request = request;
context.response = response;
context.run(doWork);
})
server.listen(8080)
function doWork() {
let context = cls.get('request-context');
context.response.end(`End: ${context.id}`) //End: 1
}
Async calls
Context is retained in async calls.
let cls = require('node-cls');
let context = cls.create('myContext');
context.run(() => {
context.name = 'George';
setTimeout(onTimeout, 300);
});
function onTimeout() {
let context = cls.get('myContext');
console.log(context.name); //George
}
Nesting
Contexts can be nested, even on the same key.
let cls = require('node-cls');
let context = cls.create('myContext');
context.run(async () => {
context.name = 'George';
let context2 = cls.create('myContext');
await context2.run(onNested);
console.log(context.name) //George
});
async function onNested() {
await Promise.resolve();
let context = cls.get('myContext');
console.log(context.name); //undefined
context.name = 'John Nested';
setTimeout(onTimeout, 300);
}
function onTimeout() {
let context = cls.get('myContext');
console.log(context.name); //John Nested
}
Symbol as key
If you are a library author, use a Symbol as key to avoid conflicts with other libraries.
let cls = require('node-cls');
let key = Symbol();
let context = cls.create(key);
context.run(() => {
context.name = 'George';
setTimeout(onTimeout, 300);
});
function onTimeout() {
let context = cls.get(key);
console.log(context.name); //George
}
Await instead of run
In node 12 and above you can start a context directly instead of wrapping it in the run function. The start function returns a promise. You can leave the current context by calling exit.
let cls = require('node-cls');
async function main() {
let context = cls.create('myContext');
context.name = 'George';
await context.start();
let context2 = cls.create('myContext');
context2.name = 'John Nested';
await context2.start();
console.log(cls.get('myContext').name); //John Nested
cls.exit('myContext');
console.log(cls.get('myContext').name); //George
cls.exit('myContext');
console.log(cls.get('myContext')); //undefined
}
main();
FAQs
Continuation Local Storage based on async_hooks
The npm package node-cls receives a total of 5,029 weekly downloads. As such, node-cls popularity was classified as popular.
We found that node-cls demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
A deceptive PyPI package posing as an Instagram growth tool collects user credentials and sends them to third-party bot services.
Product
Socket now supports pylock.toml, enabling secure, reproducible Python builds with advanced scanning and full alignment with PEP 751's new standard.
Security News
Research
Socket uncovered two npm packages that register hidden HTTP endpoints to delete all files on command.