
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
shared-resource
Advanced tools
Asynchronous resources shared across async callchain via async_hooks
npm install --save shared-resource
import Resource from 'shared-resource';
const sleep = t => new Promise(resolve => setTimeout(resolve, t));
async function taskA() {
console.log('Task A', Resource.now.id);
}
async function taskB() {
await sleep(300);
console.log('Task B', Resource.now.id);
}
async function taskC() {
await sleep(1000);
console.log('Task C', Resource.now.id);
}
const main = Resource.wrap(async x => {
console.log(`Main ${x} start`, Resource.now.id);
// notice we do not await on taskC, so we need to explicitly
// add it to the current session
Resource.addTask(taskC());
await Promise.all([
taskA(),
taskB(),
]);
console.log(`Main ${x} end`, Resource.now.id);
});
main(1);
main(2);
/*
Possible output:
Main 1 start 6bcc4e3f-24ae-4188-b377-c537e59858bf
Task A 6bcc4e3f-24ae-4188-b377-c537e59858bf
Main 2 start 10babdf3-d243-487b-8881-4ddc9180cb5a
Task A 10babdf3-d243-487b-8881-4ddc9180cb5a
Task B 6bcc4e3f-24ae-4188-b377-c537e59858bf
Task B 10babdf3-d243-487b-8881-4ddc9180cb5a
Main 1 end 6bcc4e3f-24ae-4188-b377-c537e59858bf
Main 2 end 10babdf3-d243-487b-8881-4ddc9180cb5a
Task C 6bcc4e3f-24ae-4188-b377-c537e59858bf
Task C 10babdf3-d243-487b-8881-4ddc9180cb5a
*/
##Advanced Usage (extending Session)
import Resource from 'shared-resource';class Context extends Resource {
constructor() {
super();
this._awaitedValues = {};
this._storage = {};
}
get(key) {
let promise;
if (key in this._storage) {
promise = Promise.resolve(this._storage[key]);
} else {
if (!(key in this._awaitedValues)) {
const deferred = {};
(deferred.promise = new Promise(resolve => {
deferred.resolve = resolve;
})), (this._awaitedValues[key] = deferred);
}
promise = this._awaitedValues[key].promise;
}
return promise;
}
set(key, value) {
this._storage[key] = value;
if (key in this._awaitedValues) {
this._awaitedValues[key].resolve(value);
}
}
}
const sleep = t => new Promise(resolve => setTimeout(resolve, t));
async function taskA() {
const a = await Context.now.get("a");
console.log("Task A", a);
}
async function taskB() {
const b = await Context.now.get("b");
console.log("Task B", b);
}
async function taskC(a, b) {
await sleep(1000);
Context.now.set("a", a);
await sleep(200);
Context.now.set("b", b);
}
const main = Context.wrap(async x => {
console.log(`Main ${x} start`, Context.now.id);
// notice we do not await on taskC, so we need to explicitly
// add it to the current session
Context.addTask(taskC(x, x * 2));
await Promise.all([taskA(), taskB()]);
console.log(`Main ${x} end`, Context.now.id);
});
main(1);
main(2);
/*
Possible output:
Main 1 start ebe5323d-6ede-4893-89ea-c67c4a3ff332
Main 2 start 1f14b386-4e2d-4443-9237-1b735d22ea89
Task A 1
Task A 2
Task B 2
Task B 4
Main 1 end ebe5323d-6ede-4893-89ea-c67c4a3ff332
Main 2 end 1f14b386-4e2d-4443-9237-1b735d22ea89
*/
##API
###Respurce - import Resource from 'shared-resource'
Resource object connected to the pool, providing args to its constructor (inherited statically).Resource object.Resource.now.addTask(promise).fn that runs itself in a Resource, providing args to its constructor (inherited statically).promise is resolved.fn in the context of this resource instance.FAQs
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.