
Research
Malicious npm Package Brand-Squats TanStack to Exfiltrate Environment Variables
A brand-squatted TanStack npm package used postinstall scripts to steal .env files and exfiltrate developer secrets to an attacker-controlled endpoint.
Simple, sustainable communities. Minimalist bulliten board software.
Flagship instance at fishbb.fishbb.org.
go + sqlite
no javascript
12 dependencies, 2000 lines of code
go run main.go
This will setup a database with the admin user with username 'admin' and password 'admin'. You can also set a custom db path:
go build
./fishbb -path foo.db
Tagged versions should be stable. Main branch is not guaranteed to be.
FishBB is designed to require a minimal amount of infrastructure and maintenance burden for self-hosting. Please reach out to me alex@alexwennerberg.com if you are interested in running your own instance!
All FishBB data is stored in a single sqlite file. HTML templates are embedded in the Go bindary.
FishBB is VERY early in development -- expect bugs and be very wary of sensitive data. Make sure to change the admin password away from default credentials.
FishBB also runs as a 'cluster' where multiple forums can be created. These forums can either exist in the 'cluster' (as a sort of broader forum manager) or exported on their own.
The app that hosts the fishbb cluster is https://git.sr.ht/~aw/fishbb-cluster
Admin configuration is available at /control
See the comments in config.go for now (better documentation forthcoming)
Your forum can optionally allow Google Signup. You will need to create an OAuth App on Google and set the client ID and client secret in the configuration file.
The mailing list for FishBB is at https://lists.sr.ht/~aw/fishbb-devel
Feel free to use the flagship instance as well for project discussion and feedback!
FishBB is free software, if you'd like to, please donate to support development
FAQs
Unknown package
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A brand-squatted TanStack npm package used postinstall scripts to steal .env files and exfiltrate developer secrets to an attacker-controlled endpoint.

Research
Compromised SAP CAP npm packages download and execute unverified binaries, creating urgent supply chain risk for affected developers and CI/CD environments.

Company News
Socket has acquired Secure Annex to expand extension security across browsers, IDEs, and AI tools.