Research
Security News
Malicious npm Package Targets Solana Developers and Hijacks Funds
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
"Sometimes the strategic breakthrough will be a new algorithm ... Much more often, strategic breakthrough will come from redoing the representation of the data or tables. This is where the heart of a program lies."
- "The Mythical Man Month" by Fred Brooks
KOJAC is an acronym for Key Oriented JSON Application Cache. Yes you may know of Kojak, the 1970s TV cop show.
KOJAC is an opinionated design and implementation for data management within "single page" or "Rich Internet" applications. It relates most heavily to the client and data protocol. The server may continue the key/value style down to a key/value-style database if desired, but that is not necessary. KOJAC also makes sense for the client design when a standard REST-style server is to be used, but naturally multiple operations will require multiple server requests.
Single page applications require a different way of thinking, and present different challenges to traditional server-based applications. In particular, application state and user data must be managed and synchronised with the server.
Behind the design of KOJAC is the belief that how we structure and identify data has an enormous impact on the size and complexity of the application code.
Like REST, the server has "resources" eg. customers or products that the client may do CRUD (Create, Read, Update, Destroy) operations on. Unlike REST, URLs are replaced by keys. Keys follow a standard format eg. <resource>__<id>
.
Values may be of any valid JSON type ie. Null, Int, Number, String, Boolean, Array, Object. Potentially the Client, server and protocol can use the same key/value schema.
Multiple operations per http request. Freely specify a mixture of CRUD operations on any resources in a given order, and get back the results (including errors) of any operation. That means your data can be broken down to single values, and you can request just the values you need from the server.
An optional custom factory method easily converts raw JSON into your application classes and property types. When KOJAC is used with Ember.js, the included EmberModel class enables application models to be declared with typed properties, and data is intelligently converted (if required) when these properties are set. Model classes serve as a live data dictionary for your app, and provide a meaningful place for related methods. Typed properties simplify application code by reducing the need to check and convert types.
Responses from the server update the cache (by default), keeping it fresh. With frameworks like Ember, the view can bind directly to the cache key eg. {rowIdsBinding: "App.cache.products"} for display as soon as it arrives.
As date in the cache is often up to date and in your application classes, very little code is required to support or use the KOJAC framework once setup.
kojac.read('products')
...the results will eventually appear as kojac.cache.products
kojac.read(['products','brands','categories__12']).done(function(aContext) { // handle eg. aContext.results().products or aContext.ops[0].results.products or kojac.cache.products }).fail(function(aContext) { // handle aContext.error() });
kojac.create(['products']).done(function(aContext) { // handle aContext.ops[0].result or kojac.cache[aContext.ops[0].resultKey] });
FAQs
Unknown package
We found that kojac demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
Security News
Research
Socket researchers have discovered malicious npm packages targeting crypto developers, stealing credentials and wallet data using spyware delivered through typosquats of popular cryptographic libraries.
Security News
Socket's package search now displays weekly downloads for npm packages, helping developers quickly assess popularity and make more informed decisions.