
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
This is a voting application using NodeJS.
We will need the following to be installed on our system.
Run the following command to install all the packages.
➜ npm install
Set the environment by setting the environment variable NODE_ENV.
Allowed values: dev, stage, prod
➜ export NODE_ENV=dev
Set the encryption key as environment variable. Make sure it is exactly 256 bits long (32 characters).
➜ export ENCRYPTION_KEY=crypto-key-exactly-32-chars-long
Note! Encryption algorithm used: aes-256-cbc and IV length is 16.
Create a database in Postgres. Then export the following environment variables.
On my local machine the host, user, password, database and port for Postgres are the following.
Note! If you have some other values then use that.
➜ export DB_HOST=localhost
➜ export DB_USER=
➜ export DB_PASSWORD=
➜ export DB_DATABASE=votejs
➜ export DB_PORT=5432
For more details check the NOTES.md file.
Run the following command to insert the seed data in database.
➜ npm run db:seed
For development environment the following demo admin account is created when you run the db:seed command.
You can use the demo admin to explore the APIs in dev environment.
{
userName: 'demo.dev.admin',
emailId: 'demo.dev.admin@example.com',
password: 'root1234'
passcode: '123456'
}
You will find this in seed/admin.js file.
For development environment the following demo voter account is created when you run the db:seed command.
You can use the demo voter to explore the APIs in dev environment.
{
userName: 'demo.dev.user',
emailId: 'demo.dev.user@example.com',
password: 'root1234'
passcode: '123456'
}
You will find this in seed/voter.js file.
It's free :smiley:
MIT License Copyright (c) 2020 Yusuf Shakeel
If you find this project useful and interesting then feel free to support me on Patreon.
Feeling generous :smiley: Donate via PayPal
FAQs
This is a voting application using NodeJS.
We found that votejs demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.