
Research
Security News
Malicious npm Package Wipes Codebases with Remote Trigger
A malicious npm typosquat uses remote commands to silently delete entire project directories after a single mistyped install.
Microservices the simplest way conceivable.
const servify = require("servify");
// The service state
let count = 0;
// Starts a microservice with 3 API methods
servify.api(3000, {
// Squares a number
square: (x) => x * x,
// Concats two arrays
concat: (a, b) => a.concat(b),
// Increments and returns the counter
count: () => count++
}).then(() => console.log("servified port 3000"))
const servify = require("servify");
// Builds the API interface from an URL
const api = servify.at("http://localhost:3000");
// Calls API methods like normal lib functions
api.square(2)
.then(x => console.log(x));
api.concat([1,2], [3,4])
.then(arr => console.log(arr));
api.count()
.then(i => console.log(i));
Just access the url followed by a function call:
http://localhost:3000/square(2)
http://localhost:3000/concat([1,2], [3,4])
http://localhost:3000/count()
This requires ES6 Proxy support, so you need node.js 6 and up. Proxies cannot be polyfilled in earlier versions.
When all you want is to create a microservice, Express.js becomes annoyingly verbose. You have to worry about things like serializing/deserializing JSON, chosing how to format query/param inputs, picking a XHR lib on the client and so on. Servify is a ridiculously thin (50 LOC) lib that just standardizes that boring stuff. To create a microservice, all you need is an object of functions specifying your API. To interact with a service, all you need is its URL. You can then call its functions exactly like you would call a normal lib (except it returns a Promise, obviously).
FAQs
Microservices the simplest way conceivable.
The npm package servify receives a total of 342,410 weekly downloads. As such, servify popularity was classified as popular.
We found that servify demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A malicious npm typosquat uses remote commands to silently delete entire project directories after a single mistyped install.
Research
Security News
Malicious PyPI package semantic-types steals Solana private keys via transitive dependency installs using monkey patching and blockchain exfiltration.
Security News
New CNA status enables OpenJS Foundation to assign CVEs for security vulnerabilities in projects like ESLint, Fastify, Electron, and others, while leaving disclosure responsibility with individual maintainers.