
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
sdmp-node-journal
Advanced tools
An implementation of the SDMP journal in JavaScript.
This module does not verify resources or authors in any way. It simply blindly maintains a journal list.
Install it the normal npm way:
npm install sdmp-node-journal
Or by copying the code into your project some other more difficult way.
Initialize it with a string containing the full journal (according to the SDMP specs, this must contain at least the first journal line):
var NodeJournal = require('sdmp-node-journal')
var existingJournal = 'GlvAreTo0lCS...'
var journal = NodeJournal(existingJournal)
All functions and streams digest and produce an object containing some or all of the following properties:
line - The string literal of the journal line.identifier - The calculated
journal line identifier
for the object being produced.author - The key fingerprint
of the author publishing the resource.resource - The resource identifier
of the resource being published..write(journalEntry, callback)Write to the journal by calling .write on the instantiated journal. The two properties are:
journalEntry - A journal entry object containing author and resource. (If an
identifier or line property is included, this is considered an error.)callback - A traditional error-first callback function. If there are no errors, the
second parameter is a complete journal entry object for that line.The error object returned has the following possible properties:
invalidJournalEntry - The properties author and resource are not string.containsIdentifierOrLine - The property line or identifier are not falsey.For example (data truncated with ... for readability):
journal.write({
author: 'GlvAreTo...',
resource: 'OTA8fSUK...'
}, function(error, entry) {
console.log(entry.identifier) // 22tfYa3X...
})
.read(journalEntry, callback)Read from the journal by calling .read on the instantiated journal. The two properties are:
journalEntry - A journal entry object containing at least one of author, resource,
identifier, or line.callback - A traditional error-first callback function. The returned data is an array
of any lines that match all parameters on the journalEntry passed in. Journal lines
are considered to match when the line contains all of the parameters given in the
journalEntry object.The error object returned has the following possible properties:
invalidJournalEntry - At least one of author, resource, identifier, or line must
be set. All properties must be falsey or of the type string.For example (data truncated with ... for readability):
journal.read({
line: '22tfYa3X...'
}, function(error, entry) {
console.log(entry.line) // 22tfYa3X...@GlvAreTo.../OTA8fSUK...
console.log(entry.identifier) // 22tfYa3X...
console.log(entry.author) // GlvAreTo...
console.log(entry.resource) // OTA8fSUK...
})
.on('write', callback)On any call to .write, the write event is emitted. The callback is given the
journal entry object that was written to the journal.
.readAll()Returns the entire journal as an ordered array of journal entry objects.
Released under the Very Open License
FAQs
An implementation of the SDMP Journal in JavaScript.
We found that sdmp-node-journal demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.