Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
relief-valve
Advanced tools
This is a simple library for Redis Streams data type, which is used to accumulate messages until a specified threshold is reached, post which the same is available to consumer stream.
This package is based on redis stream data type and provides you with following features
npm -i relief-valve
const rvType = require('relief-valve').ReliefValve;
or import { IBatchIdentity, IRedisClient, ReliefValve } from 'relief-valve'
docker run --name streamz -p 6379:6379 -itd --rm redis:latest
const publisherInstance = new ReliefValve(client, name, 1, 1, "PubGroup", "Publisher1");
//Count based batching test
async function main(redisPool)
{
const batchsize = 10;
const publisherInstance = new ReliefValve(redisPool, name, batchsize, 1, "PubGroup", "Publisher1"); //Check out redis-abstraction package for redis pool creation.
const consumerInstance1 = new ReliefValve(redisPool, name, batchsize, 1, "ShardGroup1", "Consumer1");
let payloads = new Map<string, object>();
for (let counter = 0; counter < 100; counter++) {
const payload = { "hello": "world1", "A": "1", "Z": "26", "B": "2", "counter": counter.toString() };
const generatedId = await publisherInstance.publish(payload);
payloads.set(generatedId, payload);
//Test
const consumer1Result = await consumerInstance1.consumeFreshOrStale(3600);
//Verify
assert.notStrictEqual(generatedId, undefined);
assert.notStrictEqual(generatedId, null);
assert.notStrictEqual(generatedId, "");
if (payloads.size === batchsize) {
if (consumer1Result == undefined) throw new Error("Read failed no batch found");
assert.notStrictEqual(consumer1Result.id, undefined);
assert.notStrictEqual(consumer1Result.id, null);
assert.notStrictEqual(consumer1Result.id, "");
assert.strictEqual(consumer1Result.readsInCurrentGroup, 1);
assert.strictEqual(consumer1Result.payload.size, batchsize);
assert.deepStrictEqual(consumer1Result.payload, payloads);
const ackResult = await consumerInstance1.acknowledge(consumer1Result as IBatchIdentity);
assert.deepStrictEqual(ackResult, true);
payloads = new Map<string, object>();
}
else {
assert.deepStrictEqual(consumer1Result, undefined);
}
}
//Validate
const token = redisPool.generateUniqueToken('Test');
try {
await redisPool.acquire(token);
const keys = await redisPool.run(token, ["KEYS", "*"]);
const length = await redisPool.run(token, ["XLEN", name]);
assert.deepStrictEqual(keys, [name]);
assert.deepStrictEqual(length, 0);
}
finally {
//Release of connection is important as it makes it available for others to acquire.
await redisPool.release(token);
}
}
This project is contrubution to public domain and completely free for use, view LICENSE.md file for details.
A pooled implmentation using redis-abstraction
import { IORedisClientPool } from 'redis-abstraction';
//Define the redis connection string
const singleNodeRedisConnectionString = 'rediss://redis.my-service.com';
//Create a injector function for creating redis connection instance.
const connectionInjector = () => IORedisClientPool.IORedisClientClusterFactory([singleNodeRedisConnectionString]);
//Initialize the pool
const pool = new IORedisClientPool(connectionInjector);
//Pass it around in the application.
main(pool)
.finally(async () => {
//Remember to call shutdown which closes all connections in pool, else node.js process will not exit.
await pool.shutdown()
})
FAQs
This is a simple library for Redis Streams data type, which is used to accumulate messages until a specified threshold is reached, post which the same is available to consumer stream.
The npm package relief-valve receives a total of 92 weekly downloads. As such, relief-valve popularity was classified as not popular.
We found that relief-valve demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.