
Security News
/Research
Wallet-Draining npm Package Impersonates Nodemailer to Hijack Crypto Transactions
Malicious npm package impersonates Nodemailer and drains wallets by hijacking crypto transactions across multiple blockchains.
A Transactional Outbox implementation for Rails and ActiveRecord.
This gem aims to implement the event persistance side of the pattern, focusing only on providing a seamless way to store Outbox records whenever a change occurs on a given model (#1 in the diagram). We do not provide an event publisher, nor a consumer as a part of this gem since the idea is to keep it as light weight as possible.
If you find yourself repeatedly defining a transaction block every time you need to persist an event, it might be a sign that something needs improvement. We believe that adopting a pattern should enhance your workflow, not hinder it. Creating, updating or destroying a record should remain a familiar and smooth process.
Our primary objective is to ensure a seamless experience without imposing our own opinions or previous experiences. That's why this gem exclusively focuses on persisting records. We leave the other aspects of the pattern entirely open for your customization. You can emit these events using Sidekiq jobs, or explore more sophisticated solutions like Kafka Connect.
Add this line to your application's Gemfile:
gem 'active_outbox'
And then execute:
bundle install
Or install it yourself as:
gem install active_outbox
Create the outbox table and model using the provided generator. Any model name can be passed as an argument but if empty it will default to outboxes
and Outbox
respectively.
rails g active_outbox:model <optional model_name>
create db/migrate/20231115182800_active_outbox_create_<model_name_>outboxes.rb
create app/models/<model_name_>outbox.rb
After running the migration, create an initializer under config/initializers/active_outbox.rb
and setup the default outbox class to the new Outbox
model you just created.
rails g active_outbox:install
To allow models to store Outbox records on changes, you will have to include the Outboxable
concern.
# app/models/user.rb
class User < ApplicationRecord
include ActiveOutbox::Outboxable
end
Using the User model as an example, the default event names provided are:
This will live under ActiveOutbox::Events
wherever you include the Outboxable
concern. The intent is to define it under Object
for non-namespaced models, as well as under each model namespace that is encountered.
If you want to persist a custom event other than the provided base events, you can do so.
user.save(outbox_event: 'YOUR_CUSTOM_EVENT')
By default our Outbox migration has an aggregate_identifier
field which serves the purpose of identifying which record was involved in the event emission. We default to integer IDs, but if you're using UUIDs as a primary key for your records you have to adjust the migrations accordingly. To do so just run the model generator with the --uuid
flag.
rails g active_outbox:model <optional model_name> --uuid
If more granularity is desired multiple outbox classes can be configured. Using the provided generators we can specify namespaces and the folder structure.
rails g active_outbox:model user_access/ --component-path packs/user_access
create packs/user_access/db/migrate/20231115181205_active_outbox_create_user_access_outboxes.rb
create packs/user_access/app/models/user_access/outbox.rb
After creating the needed Outbox
classes for each module you can specify multiple mappings in the initializer.
# frozen_string_literal: true
Rails.application.reloader.to_prepare do
ActiveOutbox.configure do |config|
config.outbox_mapping = {
'member' => 'Member::Outbox',
'user_access' => 'UserAccess::Outbox'
}
end
end
Bug reports and pull requests are welcome on GitHub at https://github.com/rootstrap/active_outbox. This project is intended to be a safe, welcoming space for collaboration, and contributors are expected to adhere to the code of conduct.
The gem is available as open source under the terms of the MIT License.
Everyone interacting in the ActiveOutbox project's codebases, issue trackers, chat rooms and mailing lists is expected to follow the code of conduct.
FAQs
Unknown package
We found that active_outbox demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
/Research
Malicious npm package impersonates Nodemailer and drains wallets by hijacking crypto transactions across multiple blockchains.
Security News
This episode explores the hard problem of reachability analysis, from static analysis limits to handling dynamic languages and massive dependency trees.
Security News
/Research
Malicious Nx npm versions stole secrets and wallet info using AI CLI tools; Socket’s AI scanner detected the supply chain attack and flagged the malware.