
Security News
/Research
Wallet-Draining npm Package Impersonates Nodemailer to Hijack Crypto Transactions
Malicious npm package impersonates Nodemailer and drains wallets by hijacking crypto transactions across multiple blockchains.
Redis and Mongo for async tasks or slow servers.
Create a list on memory, save on disk.
Use ReMo to manage input queries.
Configure your queues:
# conf.json
"input" : "db:mongo:input" # All input queries
"retry" : "db:mongo:retry" # Queries not processed
"output" : "db:mongo:output" # Output for 'find'
"errors" : "db:mongo:errors" # Logging errors
"results": "db:mongo:results" # Logging results
Configure your defaults
# conf.json
{
"defaults": {
...
"url": "mongodb://127.0.0.1/remo"
...
}
}
var remo = require('remo');
var subR = redis.createClient();
var mongo = require('mongodb').MongoClient;
mongo.connect(conf.defaults.url, function(err, db) {
subR.lpop('db:mongo:input', function(err, message) {
remo.insert(db, message, function(err, results) {
subR.lpush(['db:mongo:errors', JSON.stringify(err)], empty);
subR.lpush('db:mongo:results', JSON.stringify(results)], empty);
});
});
});
Run your mongod v3 service
mongod --directoryperdb --storageEngine wiredTiger
Clean redis
redis-cli
127.0.0.1:6379>FLUSHALL
Flood redis
node lib/fill.js
#done!
Count input queries
redis-cli
127.0.0.1:6379>LLEN "db:mongo:input"
(integer) 100000
Open your monitor
redis-cli monitor
From redis to mongodb listening for changes
node lib/init.js
Play with times
#conf.json
{
"sleep": 1000, # Listen for changes every second
"queue":{
"size": 1000, # Slice whole process into blocks of 1000 queries
"wait": 0, # Time between each query
...
}
Flood redis again and see monitor
node lib/fill.js
#done!
{ rss: 81006592, heapTotal: 61790464, heapUsed: 38060592 }
Attempt with 1000 queries on 1430927005463
Mesure of processed queries
127.0.0.1:6379> LLEN "db:mongo:results"
(integer) 100000
127.0.0.1:6379> LRANGE "db:mongo:results" 0 1
1) "{\"ok\":1,\"n\":1}"
2) "{\"ok\":1,\"n\":1}"
## Redis List Expected Message
Save your messages on redis
var redis = require('redis');
var conf = require('../conf.json');
var pub = redis.createClient();
var message = conf.defaults;
message.doc = {version: 1, module: 'readme'};
message.action = 'insert';
pub.rpush(['db:mongo:input', JSON.stringify(message)], function(){});
npm install gulp
npm install gulp-jshint
gulp
FAQs
Re[dis]Mo[ngo] queue manager
The npm package remo receives a total of 9 weekly downloads. As such, remo popularity was classified as not popular.
We found that remo demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
/Research
Malicious npm package impersonates Nodemailer and drains wallets by hijacking crypto transactions across multiple blockchains.
Security News
This episode explores the hard problem of reachability analysis, from static analysis limits to handling dynamic languages and massive dependency trees.
Security News
/Research
Malicious Nx npm versions stole secrets and wallet info using AI CLI tools; Socket’s AI scanner detected the supply chain attack and flagged the malware.