
Security News
The Hidden Blast Radius of the Axios Compromise
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.
As a Web developer, I often found that I really need a HTTP server which is more comprehensive than Python SimpleHttpServer but more light-weight than Apache and Nginx.
nover <config_file>
nover -h to show an example nover config.port is not given in the top section of config files, HTTP port will be assigned to process.env.PORT.$ROOT as the shorthand of the document root defined by root.$PWD to represent the location of the config file.$DOMAIN to indicate the main domain set by domain.$PORT can be used to indicate the same port defined by port in the top section of config file./ (slash). For example, to rewrite example.com/nover the pattern should be something like ^/nover/?$ rather than ^nover/?$.data attributes of APIs and Socekts.{
"port": 8080,
"log": "true",
"origins": "*",
"credentials": "false",
"root": "/Users/nover/",
"middlewares": [
"$ROOT/middle/handler.js"
],
"top": "example.io",
"rewrite": [{
"pattern": "^/service/?$",
"replace": "/search/"
},
{
"pattern": "^/show/([0-9]+)/?$",
"replace": "/git/#/$1"
}],
"require": [
"$ROOT/addon.js"
],
"sites": [{
"url": "/",
"local": "$ROOT/server/public"
},
{
"url": "/test",
"local": "$ROOT/html"
}],
"apis": [{
"uri": "/api/name/:name",
"method": "get",
"local": "$ROOT/Workstation/nover/example/api.js",
"data": {
"version": 1
}
},
{
"uri": "/api/name",
"method": "post",
"local": "$ROOT/Workstation/nover/example/api.js"
}],
"sockets": [{
"port": "$PORT",
"local": "$PWD/socket.js"
}],
"vhosts": [{
"subdomain": "foo.$DOMAIN",
"sites": [{
"url": "/",
"local": "$ROOT/Desktop/html"
}],
"sockets": [{
"port": 8090,
"local": "$ROOT/socket/app.js"
}]
},
{
"subdomain": "bar.$DOMAIN",
"sites": [{
"url": "/",
"local": "$ROOT/Sites"
}]
}]
}
To register Node.js powered APIs, please make sure the exposes of __get, __post, __delete, __put, and __all
#!/usr/bin/env node
exports.__get = function (req, res, data) {
'use strict';
var name = req.params.name;
res.send('Hello, ' + name);
};
Please make sure your app exposes __socket for Nover.
#!/usr/bin/env node
exports.__socket = function (server, data) {
'use strict';
var io = require('socket.io').listen(server);
io.sockets.on('connection', function (socket) {
'use strict';
socket.emit('news', {hello: 'world!!!'});
socket.on('message', function (data) {
console.log(data);
});
});
};
Please make sure your module exposes __middle
exports.__middle = function (req, res, next) {
'use strict';
console.log(req.url);
next();
};
Please make sure your required Nover module exposes __require
The parameter data is an object that contains:
root directory.exports.__require = function (data) {
'use strict';
var http = data.http;
http.get('/dev/api/:username', function () {
...
});
};
Nover is licensed under MIT.
FAQs
A Node.js powered HTTP server.
We found that nover demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.