Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
node-mongodb-wrapper
Advanced tools
This package greatly simplifies working with MongoDB and Node MongoDB Native.
It removes a lot of the callback madness and provides a simple shorthand for common operations. This was used in production at Playtomic as part of a high-volume api server.
It has a rudimentary caching layer that can greatly minimize round trips to the database without introducing 3rd party dependencies, although the cache is thread-specific so multiple instances/workers/whatever will each have their own.
or just npm install node-mongodb-wrapper
Node MongoDB Wrapper provides methods for:
get
performs a find() with optional cachinggetAndCount
performs a find() + count() with optional cachinggetOrInsert
performs a find() and inserts if not existsaggregate
performs an aggregate()aggregateAndCount
, performs an aggregate and a second aggregate for countingcount
performs a count() with optional cachinginsert
performs a save()update
performs an update()move
performs a save(doc) on new collection then remove(doc) on oldremove
performs a remove()A complete suite of examples is available in the included test.js file.
var query = {filter: {x: 1, y: 2, z: 3}, cache: true, cachetime: 60};
db.get("test", "stuff", query, function(error, items) {
console.log("huzzah!");
});
or (see shorthand note below)
db.test.stuff.get(query, function(error, items) {
console.log("huzzah!");
});
In that short example "test" is one of our configured database's names:
var databases = {
test: {
address: "127.0.0.1",
port: 27017,
name: "test", // your db and this object's name must match
//username: "optional",
//password: "optional"
}
}
We're passing an object that contains a nested filter object which is the query criteria and is exactly as you would use directly, it also supports limit, sort and skip in the outer object. The query is marked as cacheable and will store the results for 60 seconds.
I saw this on mongode and thought it looked super cool, so I copied the idea.
You can use traditional db.databasename.collectionname.method as well now to save on the parameter overload. This also has the benefit of making sure your collection names are strict.
The only bad bit is you have to predefine the collection names because JavaScript has no 'catch all' property which is unfortunate, but you can do it in 3 ways and if a collection is already defined it will just skip doing it again.
db.databasename.collection("acollection");
db.databasename.collections(["an", "array", "of", "collections"]);
db.databasename.collections(callback);
The final example will query your database and create the shorthand path for any collection names without dots (eg no system.indexes).
The callback has only an error parameter so you know if it worked or not, this is an async operation and you cannot use the shorthand until it is complete.
You can either define your databases inside the included mongo-wrapper.js or pass
a same-structured object as above via db.setDatabases(dblist)
.
You can enable or disable some functionality:
var db = require("node-mongodb-wrapper");
// caching lets you store results from get, getAndCount, count ops
db.cacheEnabled = true;
db.defaultCacheTime = 60;
Because without this you end up with too much boilerplate and nesting:
var db = new Db("local", new Server("127.0.0.1", 27017));
db.open(function(error, connection) {
if(error) {
console.log("error: " + error);
return;
}
connection.authenticate(username, password, function(error) {
if(error) {
console.log("error2: " + error);
return;
}
var collection = new mongodb.Collection(connection, "stuff");
collection.find({x: 1, y: 2, z: 3}, function(error, items) {
if(error) {
console.log("error3: " + error);
return;
}
console.log("huzzah!");
});
});
});
Copyright Ben Lowry 2012. Licensed under the MIT license. Certain portions may come from 3rd parties and carry their own licensing terms and are referenced where applicable.
FAQs
A simplified interface for MongoDB
The npm package node-mongodb-wrapper receives a total of 5 weekly downloads. As such, node-mongodb-wrapper popularity was classified as not popular.
We found that node-mongodb-wrapper demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.