Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
redis-clustr
Advanced tools
This module is a relatively thin wrapper around the node redis client to enable use of Redis Cluster. It tries to be as unobtrusive as possible - mimicing the behaviour of the node_redis client.
var RedisClustr = require('redis-clustr');
var redis = new RedisClustr({
servers: [
{
host: '127.0.0.1',
port: 7000
}
]
});
redis.set('key', 'value');
Servers in the cluster will be automatically connected to (via the response of cluster slots
). Of course, to allow discovery there must be at least one server specified in the configuration.
By default, clients will be created using Redis.createClient(port, host)
. This can be overridden by providing a function which must return a node_redis client. Clients are cached so only one connection will be made to each server.
var RedisClustr = require('redis-clustr');
var RedisClient = require('redis');
var redis = new RedisClustr({
servers: [...],
createClient: function(port, host) {
// this is the default behaviour
return RedisClient.createClient(port, host);
}
});
var RedisClustr = require('redis-clustr');
var redis = new RedisClustr({
servers: [...],
slotInterval: 1000, // default: none. Interval to repeatedly re-fetch cluster slot configuration
maxQueueLength: 100, // default: no limit. Maximum length of the getSlots queue (basically number of commands that can be queued whilst connecting to the cluster)
queueShift: false, // default: true. Whether to shift the getSlots callback queue when it's at max length (error oldest callback), or to error on the new callback
wait: 5000, // default: no timeout. Max time to wait to connect to cluster before sending an error to all getSlots callbacks
slaves: 'share', // default: 'never'. How to direct readOnly commands: 'never' to use masters only, 'share' to distribute between masters and slaves or 'always' to only use slaves (if available)
createClient: function(port, host, options) {
return require('redis').createClient(port, host, options);
}, // default: redis.createClient. Function used to connect to redis, called with arguments above
redisOptions: {
// options passed to the node_redis client https://github.com/NodeRedis/node_redis#options-is-an-object-with-the-following-possible-properties
retry_max_delay: 500
// etc
}
});
Supported - when a response is given with a MOVED
error, we will immediately re-issue the command on the other server and run another cluster slots
to get the new slot allocations. ASK
redirection is also supported - we wil re-issue the command without updating the slots. TRYAGAIN
responses will be retried automatically.
Multi commands are supported but treated as a batch of commands (not an actual multi) and the response is recreated in the original order. Commands are grouped by node and sent as node_redis batches
del
, mget
and mset
)Multi-key commands are also supported and will be split into individual commands (using a batch) then have the response recreated. Only del
, mget
and mset
are supported at the moment.
Pub/Sub is fully supported. When subscribe is used, a new client will be created (connected to a random node). This client is shared for all subscriptions.
var RedisClustr = require('redis-clustr');
var redis = new RedisClustr({...});
redis.on('message', function(channel, message) { /* ... */ });
redis.subscribe('my-channel', function(err) {
redis.publish('my-channel', 'have a lovely day!');
});
Just like node_redis, listen to the error
event to stop your application from crashing due to errors. Redis Clustr automatically intercepts connection errors and will try to reconnect to the server.
FAQs
Redis cluster client
The npm package redis-clustr receives a total of 15,302 weekly downloads. As such, redis-clustr popularity was classified as popular.
We found that redis-clustr demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 4 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.