Research
Security News
Malicious npm Package Targets Solana Developers and Hijacks Funds
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
EventMachine-LE (Live Edition) is a branch of EventMachine with fixes and more features.
Well, outside the narrower git circles, "fork" has all these negative connotations, as in bad feelings after an argument, marriages divorcing, nation states splitting after a civil war, people hating each other. This is not at all the point here, so let's call this fork a "branch".
This branch incorporates interesting pull requests that are not yet included in the mainline EventMachine repository. The maintainers of that version prefer to minimize change in order to keep the stability with already existing EventMachine deployments, which provides an impressive multi-platform base for IPv4 TCP servers (e.g., Web servers) that don't need good UDP or IPv6 support.
This dedication to stability is helpful for production use, but can also lead to ossification. The present "Live Edition" or "Leading Edge" branch has its focus on supporting a somewhat wider use, including new Web servers or protocols beyond the HTTP Web.
To provide even more focus, this branch is currently applying its energy towards Linux and Unix/BSD/OSX environments. Java reactor and pure Ruby reactor are for now removed in this branch, and Windows/Cygwin support is untested. This may very well change later, once interesting pull requests come in.
EventMachine-LE draws from a number of dormant pull requests on the mainline version of EventMachine. New proposals will also directly come to EventMachine-LE and will be included once they are tested.
This is not a "development branch" — we do use EventMachine-LE in production, just beyond the focus of mainline EventMachine.
The intention is that EventMachine-LE is always a drop-in replacement for EventMachine, just with additional (and fixed) functionality.
The list of additions and improvements will grow over time. Currently the following features/fixes have been applied in EventMachine-LE:
close_connection
after a connection has been unbind
: ept.EM.system
when unicode characters used (funny-falcon).EM::Connection#send_error_handling=mode
(cabo).EM::attach_server
added (ramonmaruko).EM::RestartableTimer
added (adzap).EM::get_max_timers
and EM::set_max_timers
are removed (they still exist but do nothing). This solves the annoying "RuntimeError: max timers exceeded" exception.EM::Iterator
(fl00r).EM::Protocols::LineProtocol
and have it autoload (gaffneyc).EM::Protocols::SmtpServer
: support multiple messages per one connection and login auth type (bogdan).EM::Queue
to avoid shift/push performance problem (grddev).EM::Connection
option for start_tls()
method: :ssl_version
(valid values are :SSLv23
, :SSLv3
and :TLSv1
, default value is :SSLv23
).EM::Connection
option for start_tls()
method: :cipher_list
(valid values are any OpenSSL cipher string, default value is "ALL:!ADH:!LOW:!EXP:!DES-CBC3-SHA:@STRENGTH"
).Install the current stable version of EventMachine-LE:
gem install eventmachine-le
If you want the last beta version (not fully tested) install it by using --pre
option:
gem install eventmachine-le --pre
Using EventMachine-LE within your project just requires loading it as follows:
# First load EventMachine-LE. require "eventmachine-le" # NOTE: It does not hurt to call "require 'eventmachine'" later # (it has no effect at all). # Then load any other Ruby Gem depending on EventMachine so it # will use EventMachine-LE. require "em-udns"
By doing this, you will avoid conflicts with the main EventMachine Gem (if it's also installed).
This branch is mantained by Carsten Bormann and Iñaki Baz Castillo.
FAQs
Unknown package
We found that eventmachine-le demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 3 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
Security News
Research
Socket researchers have discovered malicious npm packages targeting crypto developers, stealing credentials and wallet data using spyware delivered through typosquats of popular cryptographic libraries.
Security News
Socket's package search now displays weekly downloads for npm packages, helping developers quickly assess popularity and make more informed decisions.