
Security News
The Hidden Blast Radius of the Axios Compromise
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.
SPAM is a module for simple node.js process management, and wraps the cluster module. It has nothing to do with email spam.
Yarn is recommended as a package manager, but npm can be used as an alternative.
To install:
# install yarn if required
npm install -g yarn
yarn add spam
To create some processes, using the spawn method. This takes the following parameters:
var spam = require('spam');
// to create 4 processes using the myscript.js script - ready on listen(),
// created in parallel, with a timeout of 60 seconds
spam.setScript('./myscript.js');
spam.spawn(
{
number: 4,
timeout: 60000,
strategy: 'parallel'
}, function(err) {
// callback occurs when all processes have declared they are working
// or a timeout occurs
if (err) {
console.log('oops');
}
});
// to create 2 processes callback is called when 'ready' message sent, not on 'listen'
// created in series, with no timeout
spam.spawn(
{
number: 2,
timeout: 0,
strategy: 'serial',
readyOn: 'ready'
}, function(err) {
// callback occurs when all processes have declared they are working
// or a timeout occurs
if (err) {
console.log('oops');
}
});
If you want to log what's going on in SPAM
spam.on('log', function(message) {
// do some logging
console.log('SPAM: ' + message);
});
If you want to gracefully restart all the processes, by starting a new worker before killing the old worker, do this with the restart method.
// graceful restart of all the processes
spam.restart({ strategy: 'series' }, function(err) {
if (err) {
console.log('oops');
}
});
To stop all the processes:
// stop all
spam.stop(function() {
console.log('stop initiated')
});
NOTE: The scripts that are run, either need to run server.listen() or emit a specific 'ready' message. If they do not do this, then SPAM will assume they've not started and time them out. You can emit a 'ready' message using a convenience function or explicitly using process.send();
// using the signal module
var signal = require('spam').signal;
signal.ready();
// using the process.send method
process.send({ cmd: 'ready'});
To run the npm unit tests, install development dependencies and run tests with 'npm test' or 'make'.
# clone repo and install dependencies
git clone git@github.com:iandotkelly/spam.git
cd spam
yarn
# run tests
yarn test
Coverage can be measured after running the tests, and an html coverage report is written in the coverage/lcov-report directory:
open coverage/lcov-report/index.html
If you contribute to the project, tests are written in mocha, using should.js or the node.js assert module.
FAQs
Wrapper around cluster module to simplify multi-process work
We found that spam demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.