
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
h1. Resque for Node.js
p. "Resque":http://github.com/defunkt/resque is a "redis":http://code.google.com/p/redis/ backed task queue inspired by "delayed job":http://github.com/tobi/delayed_job. "Node.js":http://nodejs.org is a javascript runtime built on the "v8 engine":http://code.google.com/p/v8/.
h2. Why?
Resque.js allows you to chunk together blocks of concurrent code and work through them serially across multiple worker processes & machines. The advantage of building this as drop-in compatible resque workers is that the monitoring interface (resque-web) is already written and it provides a nice queue interface between Rails and node. You're probably already running resque for Rails; use it for Node, too.
h2. Install
@npm install resque@ or git clone.
h2. Additional Dependencies
"Fictorial's Redis client":http://github.com/fictorial/redis-node-client must be available somewhere on the load path before @resque.js@ is required.
h2. Use
h3. sandwich_worker.js
var sandwichWorker = exports
sandwichWorker.makeMeASandwich = function (sandwich) {
var job = this
makeSandwich (sandwich, function (err, result) {
if (err) job.fail ({ error: err })
else job.succeed ()
})
}
sandwichWorker.SomeRubyTask = function () {
require ('sys').puts ("This task could have been pulled off a shared queue")
this.succeed ()
}
@success()@ and @failure(error)@ callbacks are provided and can be passed in through async code to be called on completion, which frees up the worker to take another job off the queue.
h3. Gentlemen, start your workers
To start the worker, @WORKER=sandwich_worker.js QUEUE=sandwich_factory bin/node-resque-worker@. You can optionally provide a url to redis, like @WORKER=sandwich_worker.js QUEUE=* REDIS=redis.example.com:9876 bin/node-resque-worker@
To stop the worker gracefully (finishing the last task), send a QUIT signal. To stop the worker less gracefully, send a KILL signal.
h3. Enqueueing tasks
#!/usr/bin/env node
var resque = require ("resque").connect ()
resque.enqueue ('sandwich_factory', 'makeMeASandwich',
{ bread: 'Acme Levain'
, cheese: 'Cowgirl Creamery St Pat'
, greens: ['arugula']
, mustard: true
})
This code adds a @makeMeASandwich@ request to the @sandwich_factory@ resque queue.
h3. Namespaces
By default, resque uses the redis namespace of @resque:@. If you require resque as follows, you can use a different namespace:
var resque = require ("resque").connect ({ namespace: "node-only" })
...
h3. Providing a Redis connection
If you already are connected to redis in your app, you can use that client instead of creating a new one. To do so:
var redisClient = require ("redis").createClient ()
, resque = require ("resque").connect ({ redis: redisClient })
...
h3. Specifying Redis port & host
If Redis is not running locally or is not bound to the default Redis port & host (localhost:6379), you can provide port and host as follows:
var resque = require ("resque").connect ({ host: 'redis.production.example.com', port: 1337 })
...
h3. Cleaning stale workers
At any point, you can call @require ("resque").connect({...}).cleanStaleWorkers ()@, which will ensure that any dead workers have been removed from resque. This is called at the start of @node-resque-worker@.
h2. Maturity & Contribution
This is fairly immature code, but we'll be using it for a production app, so it will see significant iteration and improvement in the near future. To help out, fork, commit, push, & request pull.
h2. Contributors
FAQs
resque (a redis-backed work queue) for node
We found that resque demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.