
Research
Namastex.ai npm Packages Hit with TeamPCP-Style CanisterWorm Malware
Malicious Namastex.ai npm packages appear to replicate TeamPCP-style Canister Worm tradecraft, including exfiltration and self-propagation.
typeorm-aurora-data-api-driver
Advanced tools
<!-- ALL-CONTRIBUTORS-BADGE:START - Do not remove or modify this section --> [badge-all-contributors]: https://img.shields.io/badge/all_contributors-3-orange.svg <!-- ALL-CONTRIBUTORS-BADGE:END --> [.
⚠ Data API currently destroys any timezone information returning everything in UTC. Be aware of that when using Postgres 'timestamp with time zone', 'time with time zone' and similar types.
yarn add typeorm-aurora-data-api-driver
or
npm i --save typeorm-aurora-data-api-driver
const connection = await createConnection({
type: 'aurora-mysql',
database: 'test-db',
secretArn: 'arn:aws:secretsmanager:eu-west-1:537011205135:secret:xxxxxx/xxxxxx/xxxxxx',
resourceArn: 'arn:aws:rds:eu-west-1:xxxxx:xxxxxx:xxxxxx',
region: 'eu-west-1',
serviceConfigOptions: {
// additional options to pass to the aws-sdk RDS client
},
formatOptions: {
// additional format options to pass to the Data API client
}
})
Or if you're using Postgres:
const connection = await createConnection({
type: 'aurora-postgres',
database: 'test-db',
secretArn: 'arn:aws:secretsmanager:eu-west-1:537011205135:secret:xxxxxx/xxxxxx/xxxxxx',
resourceArn: 'arn:aws:rds:eu-west-1:xxxxx:xxxxxx:xxxxxx',
region: 'eu-west-1',
serviceConfigOptions: {
// additional options to pass to the aws-sdk RDS client
},
formatOptions: {
// additional format options to pass to the Data API client
}
})
After you done that you can use the connection just as you did with any other connection:
const postRepository = connection.getRepository(Post)
const post = new Post()
post.title = 'My First Post'
post.text = 'Post Text'
post.likesCount = 4
const insertResult = await postRepository.save(post)
This driver uses the Data API Client. To pass additional options to it, use serviceConfigOptions and formatOptions properties.
By default, this driver will try to cast entity fields on insert and update queries using entity metadata and Data API client's type casting.
This allows using UUID and enum columns which wouldn't be possible before. To disable this behavior, set the formatOptions.castParameters to false.
You can specify casting for query parameters as well. To do that pass an object with properties value and cast
const dbPost = await postRepository.findOne({
title: {
value: 'f01bdc12-ed72-4260-86aa-b7123f08cab9',
cast: 'uuid',
},
})
Alternative way of automatically cast your UUID ids is to enable automatic casting of UUID (based on regex) by passing enableUuidHack: true to formatOptions.
If you want to fix a bug or add a feature for this driver, this section will help you get started. Let's start with a simple case where you don't need to touch any code in the TypeORM itself.
yarn to install dependenciesnpm i --no-save typeorm. You can also install a specific version of the ORM.yarn build to build the code of the driver itself. You will also need to run this command when you make changes in the files under /src directory.After that, you can run tests to validate your setup.
For Postgres:
docker-compose -f docker/pg.yml up -d
For MySQL:
docker-compose -f docker/mysql.yml up -d
For Postgres:
yarn test:pg-func
For MySQL
yarn test:mysql-func
Once you verified that your setup is correct by running tests, it's time to actually make changes you'd like. A perfect start would be writing a test for your scenario.
Some features like adding a connection option would require making changes in both TypeORM and this driver.
To develop against a local TypeORM repository, you'll need to replace the third step from the initial setup section with the following:
yarn linknpm i to install TypeORM dependenciesnpm run package to build TypeORM packagebuild/package directory in the TypeORM project, run the following command to make sure the TypeORM is not linked: yarn unlinkbuild/package directory in the TypeORM project, run two following commands: yarn link and yarn link typeorm-aurora-data-api-driveryarn link typeormWhat this will do is create symlinks where the driver will use a locally built TypeORM package and a locally built TypeORM package will use a locally built driver.
<driver repo directory>/node_modules/typeorm -> <typeorm repo directory>/build/package
<typeorm repo directory>/build/package/node_modules/typeorm-aurora-data-api-driver -> <driver repo directory>
Unfortunately, every time you need to make a change in the TypeORM directory you'll need to rerun steps 4-7 which is very slow. Please submit a PR updating this readme if you find a nicer way of doing it.
Thanks goes to these wonderful people (emoji key):
Daniel Pecos Martinez 💻 🐛 | Calvin 💻 📖 ⚠️ | Vít Herain 💻 🐛 |
This project follows the all-contributors specification. Contributions of any kind welcome!
FAQs
<!-- ALL-CONTRIBUTORS-BADGE:START - Do not remove or modify this section --> [badge-all-contributors]: https://img.shields.io/badge/all_contributors-3-orange.svg <!-- ALL-CONTRIBUTORS-BADGE:END --> [
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Malicious Namastex.ai npm packages appear to replicate TeamPCP-style Canister Worm tradecraft, including exfiltration and self-propagation.

Product
Explore exportable charts for vulnerabilities, dependencies, and usage with Reports, Socket’s new extensible reporting framework.

Product
Socket for Jira lets teams turn alerts into Jira tickets with manual creation, automated ticketing rules, and two-way sync.