
Research
/Security News
9 Malicious NuGet Packages Deliver Time-Delayed Destructive Payloads
Socket researchers discovered nine malicious NuGet packages that use time-delayed payloads to crash applications and corrupt industrial control systems.
本项目是对原个人 Java 项目 qycms 的 GoLang 版改造, 由于时间有限,这一版直接使用了B站的开源微服务框架 Kratos ,配套前端项目 qyblog-web,采用 vue3 + Ant Design Vue重构,使用 nuxt3 实现 ssr,小程序部分使用 uni-app 重构。
项目目前以个人博客自用为主,加上微服务化会增加实际运行成本,短期内不会有微服务化的考虑。目前实现了如下的基础功能。
http://xxx/go/xxx 的格式部分待做功能
项目目录及作用如下,属于标准的 Kratos 的单体应用模板,基本上是遵循 project-layout 的。
v1.RegisterUserHTTPServer(srv, userService)的语句。# 创建api
kratos proto add api/qycms_bff/admin/v1/qy_admin_api_group.proto
kratos proto add api/qycms_bff/web/v1/qy_web_article.proto
# 生成api
kratos proto client api/
kratos proto client internal/qycms_blog/conf/conf.proto
暂时需要手动在 Makefile 文件中手动配置需要生成 API 的文件,然后执行 make swagger 会在对应的文件夹下面生成json文件
暂时将目前配置的部分接口文档复制到了 doc/api 文件夹下面一份。
go install github.com/go-kratos/kratos/cmd/kratos/v2@latest
# Create a template project
kratos new server
cd server
# Add a proto template
kratos proto add api/server/server.proto
# Generate the proto code
kratos proto client api/server/server.proto
# Generate the source code of service by proto file
kratos proto server api/server/server.proto -t internal/service
go generate ./...
go build -o ./bin/ ./...
./bin/server -conf ./configs
# Download and update dependencies
make init
# Generate API files (include: pb.go, http, grpc, validate, swagger) by proto file
make api
# Generate all files
make all
# install wire
go get github.com/google/wire/cmd/wire
# generate wire
cd cmd/server
wire
# build
docker build -t <your-docker-image-name> .
# run
docker run --rm -p 8000:8000 -p 9000:9000 -v </path/to/your/configs>:/data/conf <your-docker-image-name>
FAQs
Unknown package
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Socket researchers discovered nine malicious NuGet packages that use time-delayed payloads to crash applications and corrupt industrial control systems.

Security News
Socket CTO Ahmad Nassri discusses why supply chain attacks now target developer machines and what AI means for the future of enterprise security.

Security News
Learn the essential steps every developer should take to stay secure on npm and reduce exposure to supply chain attacks.