
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
"River Core" is a minimal set of functions for building computational graphs.
Computational graphs, in essence, are networks of functions. But unlike common functions, River nodes receive their inputs and emit their outputs independently from one another, and instead of parameters, values get passed in and emitted through ports.
npm i river-core
The River core API consists of three functions:
createNode(outFields, createInPorts)connect(outPort, inPort)disconnect(outPort[, inPort])createNode(outFields, createInPorts)Creates a node with the specified output and input ports. As output ports have no logic associated with them, only their names are required.
The function createInPorts() takes one argument, outputs' which is a
lookup of functions emitting on the node's output ports, and returns
functions in a similar structure but for input ports.
Both input and output functions take two arguments:
value, which is the value being sent ot / emitted by the node, andtag, which identifies the impulse throughout the graph.createNode() returns a Node object, with at least two properties:
i, a collection of functions that serve as the node's input portso, a collection of structures that serve as output ports (the specifics
of these structures are not relevant to their usage)import {createNode} from "river-core";
type In = {d_in: number};
type Out = {d_out: number};
const node = createNode<In, Out>(["d_out"], (outputs) => ({
d_in: (value, tag) => outputs.d_out(value, tag)
}));
const core = require("river-core");
const node = core.createNode(["d_out"], (outputs) => ({
d_in: (value, tag) => outputs.d_out(value, tag)
}));
connect(outPort, inPort)Connects an output port to an input port. After a connection is made, when a node emits a value on one of its connected output ports, that value will be used to invoke all connected input ports.
It's worth noting that input ports are simply functions, and therefore it's
possible to 'connect' an output port to a function, eg. console.log.
import {connect} from "river-core";
// initializing node1 & node2
connect(node1.o.d_out, node2.i.d_in);
const core = require("river-core");
// initializing node1 & node2
core.connect(node1.o.d_out, node2.i.d_in);
disconnect(outPort[, inPort])Disconnects an input port from an output port, or, disconnect all input ports from an output port.
import {disconnect} from "river-core";
// initializing & connecting node1 & node2
disconnect(node1.o.d_out, node2.i.d_in);
disconnect(node1.o.d_out);
const core = require("river-core");
// initializing & connecting node1 & node2
core.disconnect(node1.o.d_out, node2.i.d_in);
core.disconnect(node1.o.d_out);
River Core exports the following types:
Any: Lookup with string keysInPort: Describes an input portInPorts: Describes a set of input ports. Usually corresponds to the i
property of nodes.Node<In, Out>: Describes a node, where In and Out describe the value
type carried by each input and output port, respectively.OutPort: Describes an output portOutPorts: Describes a set of input ports. Usually corresponds to the o
property of nodes.Outputs: Describes a set of functions that invoke connected input ports.Tag: Identifies impulses. (In turn, an impulse is an identifiable input
that ripples through multiple nodes throughout the graph.)In practice, createNode() is not invoked directly, as one would have to
supply types (for TypeScript), output port names, and the function
createInPorts() on each call. Instead, createNode() usually gets wrapped
inside an outer factory function which has these already bundled.
The example below will produce the same node as the ones above, in a reusable way. For those coming from an OOP background, this would be analogous to subclassing.
import {createNode, Node} from "river-core";
type In = {d_in: number};
type Out = {d_out: number};
type Forwarder<V> = Node<In, Out>
function createForwarder<V>(): Node {
return createNode<In, Out>(["d_out"], (outputs) => ({
d_in: (value, tag) => outputs.d_out(value, tag)
}));
}
const core = require("river-core");
function createForwarder() {
return createNode(["d_out"], (outputs) => ({
d_in: (value, tag) => outputs.d_out(value, tag)
}));
}
One of the most useful features of computational graphs is their composability. A number of interconnected nodes may act as as a single node themselves, making it easier to compartmentalize functionality, as well as reason about different parts of the application.
Implementing a composite node is quite simple with a factory function, which will create multiple nodes, establish internal connections, and expose specific ports of its components as its own.
import {connect, Node} from "river-core";
type In = {d_in: number};
type Out = {d_out: number};
type Composite = Node<In, Out>;
function createComposite<In, Out>(): Composite {
const forwarder1 = createForwarder();
const forwarder2 = createForwarder();
connect(forwarder1.o.d_out, forwarder2.i.d_in);
return {
i: {d_in: forwarder1.i.d_in},
o: {d_out: forwarder2.o.d_out}
};
}
const core = require("river-core");
function createComposite() {
const forwarder1 = createForwarder();
const forwarder2 = createForwarder();
connect(forwarder1.o.d_out, forwarder2.i.d_in);
return {
i: {d_in: forwarder1.i.d_in},
o: {d_out: forwarder2.o.d_out}
};
}
FAQs
Library for building computational graphs
We found that river-core demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.