Research
Security News
Malicious npm Package Targets Solana Developers and Hijacks Funds
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
github.com/alkrauss48/cyrus-lyrics-api
The API behind the CyrusLyrics iOS app, written in Go.
The purpose of this API is to connect to the Google Sheets API and allow the iOS app user to create their own spreadsheet of data for the application.
This project uses the Gin Web Framework.
This project requires the Google Sheets API. To use it, you will need to create a set of OAuth credentials, as well as enable the Google Sheets API for those credentials.
More info on creating Google OAuth credentials here
cp .env.example .env
# Next, set the PROJECT_ID; this corresponds to the Google Cloud project
# under which your OAuth credentials are created.
#
# Next, set the following Google OAuth creds in the .env file:
#
# CLIENT_ID
# CLIENT_SECRET
# REDIRECT_URI
#
# You will receive all of these from Google when creating OAuth credentials.
docker-compose up
General Routes
GET / # Root route
GET /sheets/default # List the publicly available default sheets
OAuth Routes
GET /oauth/google # Initiate the Google OAuth login
GET /oauth/google/callback # Complete the Google OAuth login
Authenticated Sheets Routes
Note: This app uses the drive.file Google Drive scope, which allows access only to the files created under with this Google app.
GET /sheets/ # Get all sheet IDs and names
GET /sheets/:id # Get a single sheet's data by ID
POST /sheets/ # Create a sheet, with a name
DELETE /sheets/:id # Delete a sheet by ID
FAQs
Unknown package
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
Security News
Research
Socket researchers have discovered malicious npm packages targeting crypto developers, stealing credentials and wallet data using spyware delivered through typosquats of popular cryptographic libraries.
Security News
Socket's package search now displays weekly downloads for npm packages, helping developers quickly assess popularity and make more informed decisions.