Research
Security News
Malicious npm Package Targets Solana Developers and Hijacks Funds
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
See lib/example_squeal.rb for the example squeal.
To run standalone, simply make your data squeal thusly:
ruby example_squeal.rb
where the squeal script includes a require 'squealer'
.
eval "", binding, __FILE__, __LINE__
instead of binding.eval
Boolean
(to integer), Symbol
(to string), Array
(to comma-seperated string)Object#import
now wraps a MongoDB cursor to provide counters and timings. Only each
is supported for now, however source
takes optional conditions.Object#import
syntax has changed. Now import.source(collection).each
rather than import.collection(collection).find({}).each
. source
returns a MongoDB cursor like find
does. See lib/example_squeal.rb for options.Object#target
verifies there is a variable in scope with the same name as the table_name
being targetted, it must be a Hash
and must have an _id
keyObject#assign
not required, infers value from source scopenil
now uses nil
as the value to Object#assign
, rather than inferring value from source scopeSquealer is for standalone operation. DO NOT use it directly from within your Ruby application. To make the DSL easy to use, we alter some core types:
Hash#method_missing
- You prefer dot notation. JSON uses dot notation. You are importing from a data store which represents collections as arrays of hashmaps. Dot notation for navigating those collections is convenient. If you use a field name that happens to be a method on Hash you will have to use index notation. (e.g. kitten.toys
is good, however kitten.freeze
is not good. Use kitten['freeze']
instead.)NilClass#each
- As you are importing from schemaless repositories and you may be trying to iterate on fields that contain embedded collections, if a specific parent does not contain one of those child collections, the driver will be returning nil
as the value for that field. Having NilClass#each
return a []
for a nil is convenient, semantically correct in this context, and removes the need for many nil
checks in the block you provide to Object#assign
Object
- #import
, #export
, #target
, and #assign
"keywords" are provided for convenienceSquealer doesn't use your application classes. It doesn't use your ActiveRecord models. It doesn't use mongoid (as awesome as that is), mongodoc, or mongomapper. It's an ETL tool. It could even be called a HRM (Hashmap-Relational-Mapper), but only in hushed tones in the corner boothes of dark pubs. It directly uses the Ruby driver for MongoDB and the Ruby driver for MySQL.
For now, this is specifically for importing MongoDB documents and exporting to either MySQL or PostgreSQL.
Tested on Ruby 1.8.7(-p174) and Ruby 1.9.1(-p378)
The target SQL database must have no foreign keys (because it can't rely on the primary key values and referential integrity is the responsibility of the source data store or the application that uses it).
The target SQL database must use a primary key of CHAR(24)
. For now, we've assumed that column name is id
. Each record's id
value will get the source document _id
value. There are some plans to make this more flexible. If you are actively requiring this, let Josh know.
It is assumed the target data will be quite denormalized - particularly that the hierarchy keys for embedded documents are flattened. This means that a document from office.room.box
will be exported to a record containing the id
for office
, the id
for room
and the id
for box
.
It is assumed no indexes are present in the target database table (performance drag). You may want to create indexes for pulling data out of the database Squealer exports to. Run a SQL DDL script on your MySQL database after squealing to add the indexes. You should drop the indexes before squealing again.
The target row is inserted, or updated if present. When MySQL is the export DBMS, we are using it's non-standard INSERT ... UPDATE ON DUPLICATE KEY
extended syntax to achieve this. For PostgreSQL, we use an UPDATE followed by an INSERT. Doing update-or-insert allows an idempotent event-driven update of exported data (e.g. through redis queues) as well as a bulk batch process.
Copyright © 2010 Joshua A Graham and authors.
See LICENSE.
FAQs
Unknown package
We found that squealer demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 4 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
Security News
Research
Socket researchers have discovered malicious npm packages targeting crypto developers, stealing credentials and wallet data using spyware delivered through typosquats of popular cryptographic libraries.
Security News
Socket's package search now displays weekly downloads for npm packages, helping developers quickly assess popularity and make more informed decisions.