Research
Security News
Malicious npm Package Targets Solana Developers and Hijacks Funds
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
probe_couchdb
Advanced tools
Probe CouchDB is a Javascript library which digs into every corner of a CouchDB server and fire events when it finds interesting things: users, configs, databases, design documents, etc.
Probe CouchDB is available as an NPM module.
$ npm install probe_couchdb
You can also install it globally (npm install -g
) to get a simple probe_couchdb
command-line tool.
Yes.
Probe CouchDB is an event emitter. Give it a URL and tell it to start.
var probe_couchdb = require("probe_couchdb");
var url = "https://admin:secret@example.iriscouch.com";
var couch = new probe_couchdb.CouchDB(url);
couch.start();
Next, handle any events you are interested in.
couch.on('db', function(db) {
console.log('Found a database: ' + db.url);
db.on('metadata', function(data) {
console.log(db.name + ' has ' + data.doc_count + ' docs, using ' + (data.disk_size/1024) + 'KB on disk');
})
})
Probe CouchDB is defaultable. Customize its major behaviors by setting its default options:
// Stock behavior
var probe_couchdb = require("probe_couchdb");
// Modified behavior
var proxied_probe = probe_couchdb.defaults({ http_proxy: "http://localhost:8080/" })
, probe_verbose = probe_couchdb.defaults({ log_level: "debug" })
, skips_users = probe_couchdb.defaults({ do_users : false })
, skips_designs = probe_couchdb.defaults({ do_ddocs : false })
, skips_dbs = probe_couchdb.defaults({ do_dbs : false });
// Combined behavior
var my_probe = probe_couchdb.defaults({ http_proxy: "http://localhost:8080"
, log_level : "debug"
, url : "http://admin:secret@localhost:5984"
})
// Inherited behavior
var three_dbs = my_probe.defaults({ only_dbs:["foo", "bar", "baz"] })
, B_dbs = my_probe.defaults({ only_dbs: /^b/ });
This is the object hierarchy: CouchDB → Database → Design document
db
events, containing a Database probe.ddoc
events, containing a design document probe.All events pass one parameter to your callback unless otherwise noted.
You create these using the API.
/
response)/_session
response). Check .userCtx
to see your login and roles./_config
response). If you are not the admin, this will be null
._users
database). Keys are the document IDs, values are the documents. Always includes a null
key with the anonymous user."coffeescript"
; and ping result, e.g. {"ok":true}
or {"error":"bad_ping", "reason":"no_match"}
.These events are used internally and less useful:
function(db_name)
which returns whether to probe that database.{"name":null, "roles":[]}
CouchDB probes pass database probes to your callback on the db event.
/db
response), or null
if you haven't read permission/db/_security
response), or null
if you haven't read permissionThese events are used internally and less useful:
all_docs(options, callback) | Run an _all_docs
query. The options object (if given) is querystring parameters, e.g. {"include_docs":true, startkey:["name", "S"]}
Database probes pass design document probes to your callback on the ddoc event.
/db/_design/ddoc/_info
response).language
field in the document is. Usually this is "javascript"
, or else undefined
if it was not specified"by_name"
), and then the view object (e.g. {"map":"function(doc) { ... }"}
"by_name"
"map"
or "reduce"
"function(doc) { ... }"
These events are used internally and less useful:
end_views | Indicates that all views have been processed
"_design/example"
No methods.
Often you want to know multiple things about the server. But normal EventEmitter .on()
calls will not work. For example, to determine your own user document:
// XXX: Bad code! What if the session event fires before the users event?
couch.on('users', function(users) {
couch.on('session', function(session) {
var my_id = 'org.couchdb.user:' + session.userCtx.name;
var my_doc = users[my_id];
console.log("My user doc: " + JSON.stringify(my_doc));
})
})
If the event has not yet fired, .known()
works just like .on()
. But if the event has fired already, .known()
will immediately run your callback with the event data. In other words, using .known()
you don't have to worry about event order.
// Good code.
couch.known('users', function(users) {
couch.known('session', function(session) {
var my_id = 'org.couchdb.user:' + session.userCtx.name;
var my_doc = users[my_id];
console.log("My user doc: " + JSON.stringify(my_doc));
})
})
FAQs
Spider a CouchDB server, emit events with discovered information
We found that probe_couchdb demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
Security News
Research
Socket researchers have discovered malicious npm packages targeting crypto developers, stealing credentials and wallet data using spyware delivered through typosquats of popular cryptographic libraries.
Security News
Socket's package search now displays weekly downloads for npm packages, helping developers quickly assess popularity and make more informed decisions.