Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
github.com/IBM/world-wire/api-service
Client-facing API Service, orchestrator of World Wire operations
Required Software Dependencies:
In order to run and test against the API-Service locally, you will need several steps to get set up.
The first step is to run dep at the root of the project:
make dep
Change to newly cloned utility repo and edit the nodeconfig.toml
file to contain the following:
(make sure to replace filler values with actual values)
[DISTRIBUTION_ACCOUNTS]
[DISTRIBUTION_ACCOUNTS.default]
NODE_ADDRESS = "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
NODE_SEED = "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
[IBM_TOKEN_ACCOUNT]
NODE_ADDRESS = "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
NODE_SEED = "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
[ISSUING_ACCOUNT]
NODE_ADDRESS = "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
NODE_SEED = "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
Set environment variables by copying the variables found in .env.example
to your OS's config file path: ~/.profile
.
Replace with your set GOPATH for your project.
Alternatively, for VSCode user, copy over:
launch.json.example
to launch.json
settings.json.example
to settings.json
DON'T FORGET: Replace with your set GOPATH for your project.
To open the
~/.profile
with vscode usecode ~/.profile
and then after updating the file usesource ~/.profile
to enable and set the updates
SERVICE_PORT
VERIFY_ACCOUNT_IDENTIFIER_URL
NOTIFY_NEW_ADDRESS_URL
FEDERATION_SERVICE_INTERNAL_API_URL
QUOTES_SERVICE_INTERNAL_API_URL
ISSUING_TOKEN
HORIZON_CLIENT_URL
FRIENDBOT_URL
SERVICE_DIST_ACCOUNT_KEYS_FILE
SERVICE_ISSUE_ACCOUNT_KEYS_FILE
PARTICIPANT_REGISTRY_URL
OPTIONAL: Generate JWT RS256 key (Must set ENABLE_JWT = true). To do so, run:
ssh-keygen -t rsa -b 4096 -f jwtRS256.key
Don't add passphrase
openssl rsa -in jwtRS256.key -pubout -outform PEM -out jwtRS256.key.pub
cat jwtRS256.key
cat jwtRS256.key.pub
This step assumes you have npm installed from nodejs.org and already have Golang etc. installed on your system
You will need to change directories to the api-service directory:
cd ~/<GOPATH>/src/github.ibm.com/gftn/api-service
Mac only: Install homebrew if not installed:
npm install -g homebrew
After finishing the homebrew installation or if already installed previously, use the following command to install Glide:
brew install glide # Mac OSX
curl https://glide.sh/get | sh # all other OSes
With Glide installed, you can now run the following from inside the api-service
directory:
glide install
This installs all the golang dependencies found in the project files in api-service.
After these packages are installed, you can build the project with the Makefile:
make
Alternative you can run each of the individual commands found in the Makefile, if the Makefile is broken or you need to do an intermediary step in between.
To build the project manually, run the following command to compile the project into an executable:
go build # general command for all OSes
go build -o api-service.exe # Windows
go build -o api-service.osx # Mac OSX
To run the project:
./api-service # or ./api-service.exe or ./api-service.osx, etc.
Alternatively for VSCode users: go into the Debug panel, click the play button on the launch service for api-service to run the project.
The API Service should now be running locally and accepting requests on localhost:8080
, or whichever SERVICE_PORT you have set it to localhost:<SERVICE_PORT>
.
FAQs
Unknown package
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.