
Research
npm Malware Targets Telegram Bot Developers with Persistent SSH Backdoors
Malicious npm packages posing as Telegram bot libraries install SSH backdoors and exfiltrate data from Linux developer machines.
github.com/afawcett/apex-umlcanvas
Currently this tool has the following contributors, please join us!
Since Dreamforce 2013, I was contacted by John M. Daniel, who asked if it was possible to create a version of the tool without using a Heroku applicaiton, by consuming the Tooling API from Apex directly. About the same time James Loghry and I had also started working on a native Apex wrapper for the Tooling API. And so from this point forward the Apex UML tool is completly native, no Heroku instance is required!
Further information and blog posts...
NOTE: If you have installed the earlier version, don't worry, simply take the latest package install link below and it will automatically upgrade you to the native version.
This version of the tool is no longer live. If you still want to know more about consuming the API from a Canvas / Java context though you can read more about this tool at my blog post here. You can also watch the Dreamforce 2013 presentation on how it was built here and download the slides from here.
NOTE: If your org is not using My Domain, you will see a Remote Site setting message popup, follow it and then reload the page.
v1.7 Production Install or Sandbox Install - Fix for issue 14 collection size exceeded. Also migrated repo to SFDX and added Lightning support. Remote Site setup no longer required for My Domain orgs.
v1.3 Package install link (depricated)
v1.2 Package install link (depricated)
There has been great deal of interest in this tool and enhancing it since i launched it ahead of Dreamforce 2013. I'd like to start a list of ideas and enhancements for and invite the community to help build those features. Here is a list of ideas.
FAQs
Unknown package
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Malicious npm packages posing as Telegram bot libraries install SSH backdoors and exfiltrate data from Linux developer machines.
Security News
pip, PDM, pip-audit, and the packaging library are already adding support for Python’s new lock file format.
Product
Socket's Go support is now generally available, bringing automatic scanning and deep code analysis to all users with Go projects.