
Security News
Socket Releases Free Certified Patches for Critical vm2 Sandbox Escape
A critical vm2 sandbox escape can allow untrusted JavaScript to break isolation and execute commands on the host Node.js process.
a taco themed PaaS for node.js servers. warning: still alpha-quality

the main goal of taco is to fully automate and configure everything so that from the time
when you create your server you never have to manually ssh in and configure things from
the server shell.
git push taco master to deploy)npm install and npm start on your app to build + deploy itfeel free to open an issue for these and declare that you want to work on them, then send a PR :)
taco logs, taco restart appname etcit takes around 10 minutes to get up and running with taco
note: you can use any server running a brand new ubuntu 13.04 install, digital ocean just happens to be the cheapest way to get one if you don't already have one
*.yourdomain.com -> IP
yourdomain.com -> IP
once you have your DNS set up properly you can run the magic one liner: ./bootstrap.sh admin yourdomain.com
or follow these step by step instructions (recommended for first-timers):
I wrote a couple of npm modules to automate this, here's how to run them:
npm install install-node-on-ubuntu install-nginx-on-ubuntu -g
install-nginx-on-ubuntu root@yourdomain.com
install-node-on-ubuntu root@yourdomain.com
this step is optional, but recommended so that you don't get pwn3z0red
run https://gist.github.com/maxogden/8551202 which:
one-liner:
wget -qO- https://gist.github.com/maxogden/8551202/raw/3de4f5b818da41df8a40f41f89166a2af98f4da1/initial.sh | ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no root@example.com
(replace example.com with your server)
or if you want the user to be something other than admin you can log in to your server and run it this way:
wget -qO- https://gist.github.com/maxogden/8551202/raw/3de4f5b818da41df8a40f41f89166a2af98f4da1/initial.sh | sudo NEW_USER=admin bash
note: use root if you didn't do the recommended security steps above, otherwise use admin as the user
run these from your local machine:
npm install taco -g
install-taco-on-ubuntu admin yourdomain.com
npm install and npm start as the only two setup stepsprocess.env.PORThere is an example app: https://github.com/maxogden/hello-world-server.git
to deploy the example:
git clone https://github.com/maxogden/hello-world-server.git
cd hello-world-server
git remote add taco http://taco.mydomain.com/hello.git
the end of the remote url should be app-subdomain.git, so in this case the app
will deploy to hello.mydomain.com
now you just need to push:
git push taco master
Counting objects: 38, done.
Delta compression using up to 4 threads.
Compressing objects: 100% (26/26), done.
Writing objects: 100% (38/38), 3.45 KiB | 0 bytes/s, done.
Total 38 (delta 4), reused 0 (delta 0)
remote: Received hello.git
remote: Running npm install...
remote: npm http GET https://registry.npmjs.org/hat/0.0.3
remote: npm http 304 https://registry.npmjs.org/hat/0.0.3
remote: hat@0.0.3 node_modules/hat
remote: Deployed app at http://hello.yourdomain.com
To http://mydomain.com:8080/hello.git
* [new branch] master -> master
Create a new taco instance.
taco expects these minimum values in the opts object:
opts.dir: base path to hostopts.host: vhost (http host) to route incoming requests withopts.nginx: nginx options object, gets passed to the nginx-vhosts moduleopts.nginx.conf: path to nginx configuration fileopts.nginx.confDir: path to a folder where new nginx config files can be createdopts.nginx.pidLocation: path to the nginx pid fileready will be called when taco is ready to handle requests
Handle an incoming HTTP request/response.
sudo DEBUG=* USER=admin PASS=pass taco foo.com /usr/local/etc/nginx/conf.d/ /usr/local/etc/nginx/nginx.conf /var/run/nginx.pid
npm install
sudo npm test
taco doesn't implement all the bells and whistles needed to deploy 'application stacks' like LAMP or Rails. all you get is support for node programs that can be configured + started using npm install and npm start.
anything that can't be installed from npm (e.g. non in-process databases) needs more complexity, and the existing PaaS platforms are probably what you want. taco has no complex backing services http://12factor.net/backing-services
FAQs
a taco themed PaaS for node.js servers
The npm package taco receives a total of 29 weekly downloads. As such, taco popularity was classified as not popular.
We found that taco demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
A critical vm2 sandbox escape can allow untrusted JavaScript to break isolation and execute commands on the host Node.js process.

Research
Five malicious NuGet packages impersonate Chinese .NET libraries to deploy a stealer targeting browser credentials, crypto wallets, SSH keys, and local files.

Security News
pnpm 11 turns on a 1-day Minimum Release Age and blocks exotic subdeps by default, adding safeguards against fast-moving supply chain attacks.