Research
Security News
Threat Actor Exposes Playbook for Exploiting npm to Build Blockchain-Powered Botnets
A threat actor's playbook for exploiting the npm ecosystem was exposed on the dark web, detailing how to build a blockchain-powered botnet.
A pluggable, recursive, async, JavaScript object resolver.
ES5 compliant, you might need a polyfill for older browsers.
This lib uses commonjs modules, suitable for nodejs, webpack, browserify, or other web bundler.
It was designed to be light, and so has few dependencies. There is room for optimizations. Particularly to make things immutable. (I've avoided including the entire immutable js lib, despite how fun it is. Looking forward to a immutable-lite
version :smile:)
So we give SpecMap
some JSON, a bunch of plugins and we get some JSON out.
A plugin is a function/object or the specmap
property of any given object.
A plugin will receive (Array, SpecMapInstance) as arguments.
The array will be an array of patches, to work with. And the SpecMap instance is the current instance of SpecMap, which includes some important methods.
Each plugin only handles stuff it hasn't seen before to make it faster.
Plugins run in the order you define. But they work a little differently, than you are perhaps used to.
This is the recursive part of SpecMap.
In summation each plugin will get a chance to work with each new patch. Each patch will first be seen by the first plugin, then the second, etc.
To accomplish all this, we work in patches
. Each plugin will receive a bunch of patches
and it can return more patches
.
A patch
is an object like this... {op: 'add', path: ['over', 'here'], value: 'something'}
It says, add this value to this path.
These JSON-Patches are supported...
To make life easier, you can use helper methods instead of writing out {op: 'merge', path...}
. They can be found over in require('specmap/lib')
. And used like this... lib.add(['some', 'path'], {something: true})
Those are the normal patches, there are a few more interesting ones...
Error
, which will be collected and spat out at the end for the user to deal with.{type: 'context', path: Path, value: Any}
, add some context for other plugins (or your own) to read about later on.
{...any patch, whose
value is a promise}
, these patches are the async part. Which get put into a special queue, and as soon as they resolve they get put back into the normal patch queue for plugins to handle
.get
to fetch promised values.Plugins need a way to access the current state of the spec, and that cannot be done with patches, (unless you know a way?). We expose a .get
method and a .getContext
method for fetching state.
Example:
// Some plugin.
function(patches, specmap) {
console.log(specmap.get(['some', 'path'])) // Whatever is at /some/path inside the current state.
specmap.getContext(['some','path']) // Some context for this path.. merged with its parents context. So you have *entire* the context for this path. Pretty cool.0
}
And because its late, and I'm starting to see funny shapes. Here is a working test to see how it comes together.
var expect = require('expect')
var mapSpec = require('specmap')
it('should download some data, and mutate the new stuff', function(){
this.timeout(10 * 1000)
return mapSpec({
spec: {
hello: 'world',
'deps': {
$ref: 'https://rawgit.com/ponelat/specmap/master/package.json#/dependencies' // a JSON-Ref... https://tools.ietf.org/html/draft-pbryan-zyp-json-ref-03
}
},
plugins: [
mapSpec.plugins.refs, // JSON-Ref plugin
// Pluins can be functions. We pass in the new patches, and the specmap instance
function (patches, specmap) {
// patches, all the /mutative/ patches (add, merge, remove, replace)
return specmap.forEachNewPrimitive(patches, function (val, key, fullPath) { // Helper to iterate over the patches
if (key === 'js-yaml' && specmap.get(fullPath) !== 'latest') { // We're working on make this easier, because every plugin runs over every change, and we don't want an endless loop
var patch = specmap.replace(fullPath, 'latest') // Use latest js-yaml :)
// patch is the atom of the system. We have helpers to build them for you
// patch = {op: replace', path: [.., 'js-yaml'], value: 'latest'}
return patch
}
})
}
]
}).then(function (res) {
expect(res).toEqual({
errors: [], // Hopefully :)
spec: {
hello: 'world',
'deps': {
// "js-yaml": "^3.5.4", when the Refs plugin added the 'deps', it introduced new patches. Which our function handled
"js-yaml": "latest", // Whoop! We mutated this!
"object-assign": "^4.0.1",
"path-loader": "^1.0.1",
"promise-polyfill": "^3.1.0"
}
}
})
})
})
FAQs
A pluggable object mutator
We found that specmap demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A threat actor's playbook for exploiting the npm ecosystem was exposed on the dark web, detailing how to build a blockchain-powered botnet.
Security News
NVD’s backlog surpasses 20,000 CVEs as analysis slows and NIST announces new system updates to address ongoing delays.
Security News
Research
A malicious npm package disguised as a WhatsApp client is exploiting authentication flows with a remote kill switch to exfiltrate data and destroy files.