Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Microservices the simplest way conceivable.
const servify = require("servify");
// The service state
let count = 0;
// Starts a microservice with 3 API methods
servify.api(3000, {
// Squares a number
square: (x) => x * x,
// Concats two arrays
concat: (a, b) => a.concat(b),
// Increments and returns the counter
count: () => count++
}).then(() => console.log("servified port 3000"))
const servify = require("servify");
// Builds the API interface from an URL
const api = servify.at("http://localhost:3000");
// Calls API methods like normal lib functions
api.square(2)
.then(x => console.log(x));
api.concat([1,2], [3,4])
.then(arr => console.log(arr));
api.count()
.then(i => console.log(i));
Just access the url followed by a function call:
http://localhost:3000/square(2)
http://localhost:3000/concat([1,2], [3,4])
http://localhost:3000/count()
This requires ES6 Proxy support, so you need node.js 6 and up. Proxies cannot be polyfilled in earlier versions.
When all you want is to create a microservice, Express.js becomes annoyingly verbose. You have to worry about things like serializing/deserializing JSON, chosing how to format query/param inputs, picking a XHR lib on the client and so on. Servify is a ridiculously thin (50 LOC) lib that just standardizes that boring stuff. To create a microservice, all you need is an object of functions specifying your API. To interact with a service, all you need is its URL. You can then call its functions exactly like you would call a normal lib (except it returns a Promise, obviously).
FAQs
Microservices the simplest way conceivable.
The npm package servify receives a total of 145,735 weekly downloads. As such, servify popularity was classified as popular.
We found that servify demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.