Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
github.com/Solar-Punk-Ltd/swarm-mobile
SwarmMobile is a bee client built with fyne using bee-lite. It can run on multiple platforms supported by fyne.
To Build from source you will need fyne.
make get-fyne
Also necessary to install the android ndk and set the following environment variables. Then add them to the PATH environment variable.
export ANDROID_HOME=$HOME/Library/Android/Sdk
export ANDROID_NDK_HOME=$ANDROID_HOME/ndk/<specific-ndk-version>
export PATH=$ANDROID_HOME:$ANDROID_NDK_HOME:$PATH
By default the target is is android/arm64 and the app ID is com.solarpunk.swarmmobile. To overwrite them set the following environment variables:
export APP_ID=<app-id>
export TARGET_OS=<target-os>
To create a package:
make package
To run without packaging on your local development environment:
go run main.go
If you wish to simulate a mobile application:
go run -tags mobile main.go
In order for the android networking to work: Copy the _android files under the net/ and syscall/ subfolders of this repo to their respective folders under your go installation, e.g.:
cp ./net/* /opt/homebrew/Cellar/go/1.22.4/libexec/src/net/
cp ./syscall/* /opt/homebrew/Cellar/go/1.22.4/libexec/src/syscall/
Furthermore, add the following build directive to the existing dnsconfig_unix, interface_linux, netlink_linux files:
//go:build !android
so that the target will be the newly added *_android files.
Based on the following github issues: dnsconfig_unix.go netlink_linux.go, interface_linux.go
By building the sources an .apk package is generated. It can be installed wiht a simple drag-and-drop on an Android device by connecting your computer via USB. Then just install the package by tapping on the installer (you might need to enable installing packages from unknown sources).
Then on your computer adb needs to be installed. Use the following script to start the adb service and listen for the logs coming from the app (it filters out the logs coming from the fyne framework and colors the lines):
DEVICE_ID=$(adb devices | awk 'FNR == 2 {print $1}')
echo "device ID: ${DEVICE_ID}"
adb logcat -v color time Fyne:V *:S ${DEVICE_ID} > swarm_mobile.log
To be able to run the app in the browser set the following environment variable:
export GOPHERJS_GOROOT=<specific-go-path>/libexec
Then run the command:
fyne serve -os wasm
For more information about the build options run:
fyne package --help
FAQs
Unknown package
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.