
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
Node.js进程互斥锁:
Linux下默认读写/dev/shm.
Notice: 这一分支下开发互斥锁版本. 如无需锁支持, 可以使用master分支HEAD的高性能版本.
原理: 由于Node的单进程单线程模型, 同一时间只允许一个阻塞任务执行,
利用这一机制在Linux内存映射文件系统/dev/shm上使用Node原生的阻塞读写函数, 可以实现多进程对同一块内存区域访问的读写互斥作用.
如果需要进一步控制资源访问, 需要用.lock/.unlock. 它会根据LockFile判断是否允许申请资源锁,
用lock(key)对一个资源的事务过程加锁, 锁在超时(默认5s)后会自动释放掉, 申请失败时会在next Tick里重试.
Notice: 由于资源访问的互斥性, 带来不可避免的同步原语, 因此任何异步执行是无意义的, 最终仍需要等待锁的释放, 所以服务端采用同步模型. 但C/S的结构允许客户端的异步请求, 这样就做到了异步互斥.
# master process
# lock server
LockProxy = require 'node-lock/proxy'
# LockServer [options]
# @options:
# + namespace: 命名空间(默认为"default")
# + dir: 共享内存位置, linux下默认为/dev/shm, osx需要手动指定一块已经创建区域
# m = LockProxy namespace: 'ddd', dir: '/Volume/shm'
# m = LockProxy namespace: 'ddd', dir: '/Volume/shm'
# 启动服务端
LockProxy().startStandAlone()
# other process
LockClient = require 'node-lock'
client = new LockClient '/tmp/-tmp-default'
# 连接服务端socket
client.connect()
.then (resource) ->
resource
.lock 'key::1'
.once 'lock', ->
resource.create 'key::1', 'value'
.once 'create', ->
resource.retrieve 'key::1'
.once 'retrieve', (ret) ->
console.log ret
resource.unlock 'key::1'
.catch (err) ->
console.error err
FAQs
Node.js lock library for multi-process read/write
We found that node-lock demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.