
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
Is Promise.all causing failures when you need to make 100s of asynchronous network calls? Do you get random file errors when writing multiple files at the same time? Do you need your async methods to be called in a specific order?
Node's Promise.all method will run all of your async methods in parallel which can cause network or file system errors. The method also prevents you from guaranteeing what order the functions are called. YASPR aims to solve these issues by
npm install yaspr
TypeScript
import { sequentialPromises } from "yaspr";
interface Params {
name: string;
timeout: number;
}
// Tracks the number of times the function was called
let count = 0;
// Async function that will will wait the designated timeout, print stuff, and return the number of times this function was called
async function someAsyncFunction(params: Params) {
return await new Promise<number>(resolve => {
setTimeout(() => {
count += 1;
console.log(`Name: ${params.name}, Timeout: ${params.timeout}`);
resolve(count);
}, params.timeout);
});
}
async function run() {
// Promise.all will resolve the shortest timeouts first.
// YASPR will resolve in the order they are received.
const params: Array<Params> = [
{ name: "Michael", timeout: 1000 },
{ name: "Jim", timeout: 500 },
{ name: "Pam", timeout: 750 },
{ name: "Dwight", timeout: 501 }
];
console.log("Running using `Promise.all`. Output order based on timeout");
console.log(await Promise.all(params.map(someAsyncFunction)));
count = 0;
console.log("Running promises sequentially");
console.log(await sequentialPromises(params, someAsyncFunction));
}
(async () => await run())();
git clone https://MikeWestbrook@dev.azure.com/MikeWestbrook/MikesNodeModules/_git/yaspr
npm run build
npm run watch
Runs a simple example.
npm run sample
FAQs
Yet another sequential promise resolver
The npm package yaspr receives a total of 0 weekly downloads. As such, yaspr popularity was classified as not popular.
We found that yaspr demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.