
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
Webcom is the Orange Backend-as-a-Service / Serverless solution. It provides integrated functions for:
This platform drastically reduces time and cost to implement and deploy mobile and web applications in production.
More information on https://datasync.orange.com.
Several flavors of the javascript SDK are available within the Webcom package, you must select the right one depending on your execution environment and the service(s) you need. The file name must guide you in your choice:
-node suffix the library is built for a Node.js environment, otherwise it targets a Web application.-auth, a -rxdb or a -sldb suffix the library embeds respectively the
Authentication, ReactiveDb or the
ServerlessDb service (a light version of this service, without the realtime
subscription capabilities also exists with the -sldbLite suffix).-debug suffix the library is usable during your development for debugging purpose (warning:
footprint of such a library flavor is much larger, as it is neither compressed nor optimized).webcom.js and webcom-node.js libraries are versions that embed all services and all APIs,
including the deprecated ones.Examples:
// for Web Application
webcom.js // the full version including all deprecated APIs
webcom-auth-rxdb.js // a version with Authentication and ReactiveDb services
// for NodeJs based servers
webcom-node.js // the full version including all deprecated APIs
webcom-auth-sldbLite-node.js // a version with Authentication and the lite version of ServerlessDb service
<script type='text/javascript' src='https://cdn.jsdelivr.net/npm/webcom@3.12.0/webcom.js'></script>
npmFirst install the Webcom package
npm install webcom@3.12.0
And then reference the installed javascript library in your web application:
script tag<script type='text/javascript' src='<YOUR_LIBRARY_PATH>/webcom.js'></script>
import directiveimport 'webcom/webcom.js';
First install the Webcom package
npm install webcom@3.12.0
And then load the javascript library in your Node.js application
const Webcom = require('webcom');
const myApp = Webcom.App('<your-app>');
The Authentication ReactiveDb and ServerlessDb services may then be accessed respectively through the
myApp.authentication, myApp.reactiveDb and myApp.serverlessDb properties.
const node = myApp.serverlessDb.rootNode.relativeNode("the/targeted/path");
node.subscribe(Webcom.Event.ValueChange, Webcom.Callback(snapshot => {
// this callback is called each time the data in your app at "the/targeted/path" is updated
console.info("data in my app is now:", snapShot.val());
}));
You can also send notifications to a webhook instead of a javascript callback (to do so, you must configure the
"myWebhook" webhook on the Webcom developer console):
node.subscribe(Webcom.Event.ValueChange, Webcom.Webhook("myWebhook", "aContext"));
node.set({foo: 'bar'})
.then(() => console.info("write operation succeeded"))
.catch(error => console.info("write operation failed:", error.message));
While the set method overwrites data, the merge one completes existing data:
node.merge({baz: 42});
The whole data tree of your application is now
{
"the": {
"targeted": {
"path": {
"foo": "bar",
"baz": 42
}
}
}
}
Applications hosted by a web browser should run straightforward.
If you run a Node.js application, be careful to the network configuration: behind a company proxy, you just have to
set up usual environment variables https_proxy and http_proxy (or their uppercase counterparts):
export http_proxy="http://my-proxy.my-company.com:8080"
Note that the no_proxy environment variable is also taken into account.
FAQs
Webcom library
The npm package webcom receives a total of 2,165 weekly downloads. As such, webcom popularity was classified as popular.
We found that webcom demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.