Research
Security News
Malicious npm Package Targets Solana Developers and Hijacks Funds
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
github.com/auriamg/macdylibbundler
Mac OS X introduced an innovative and very useful way to package applications : app bundles. While their design has all that is needed to ease distribution of resources and frameworks, it seems like dynamic libraries (.dylib) are very complicated to distribute. Sure, applications developed specifically for OS X won't make use of them, however applications ported from Linux or other Unices may have dependencies that will only compile as dylibs. By default, there exists no mechanism to bundle them but some command-line utilities provided by Apple - however it turns out that for a single program it is often necessary to issue dozens of commands! This often leads each porter to develop their own "home solution" wich are often hacky, poorly portable and/or non-optimal.
dylibbundler is a small command-line programs that aims to make bundling .dylibs as easy as possible. It automatically determines which dylibs are needed by your program, copies these libraries inside the app bundle, and fixes both them and the executable to be ready for distribution... all this with a single command on the terminal! It will also work if your program uses plug-ins that have dependencies too.
It usually involves 2 actions :
In the terminal, cd to the main directory of dylibbundler and type make
. You can install with sudo make install
.
Install with MacPorts
sudo port install dylibbundler
Install with Brew
brew install dylibbundler
You can contact me here on github, for instance by creating a ticket or pull request
Here is a list of flags you can pass to dylibbundler on the terminal.
-h
, --help
displays a summary of options
-x
, --fix-file
(executable or plug-in filepath)
Fixes given executable or plug-in file (a .dylib can work too. anything on which `otool -L` works is accepted by `-x`). Dylibbundler will walk through the dependencies of the specified file to build a dependency list. It will also fix the said files' dependencies so that it expects to find the libraries relative to itself (e.g. in the app bundle) instead of at an absolute path (e.g. /usr/local/lib). To pass multiple files to fix, simply specify multiple `-x` flags.
-b
, --bundle-deps
Copies libaries to a local directory, fixes their internal name so that they are aware of their new location, fixes dependencies where bundled libraries depend on each other. If this option is not passed, no libraries will be prepared for distribution.
-i
, --ignore
(path)
Dylibs in (path) will be ignored. By default, dylibbundler will ignore libraries installed in
/usr/lib
since they are assumed to be present by default on all OS X installations.(It is usually recommend not to install additional stuff in/usr/
, always use/usr/local/
or another prefix to avoid confusion between system libs and libs you added yourself)
-d
, --dest-dir
(directory)
Sets the name of the directory in which distribution-ready dylibs will be placed, relative to the current working directory. (Default is
./libs
) For an app bundle, it is often convenient to set it to something like./MyApp.app/Contents/libs
.
-p
, --install-path
(libraries install path)
Sets the "inner" installation path of libraries, usually inside the bundle and relative to executable. (Default is
@executable_path/../libs/
, which points to a directory namedlibs
inside theContents
directory of the bundle.)
-s
, --search-path
(search path)
Check for libraries in the specified path
The difference between -d
and -p
is that -d
is the location dylibbundler will put files at, while -p
is the location where the libraries will be expected to be found when you launch the app. Both are often related.
-of
, --overwrite-files
When copying libraries to the output directory, allow overwriting files when one with the same name already exists.
-od
, --overwrite-dir
If the output directory already exists, completely erase its current content before adding anything to it. (This option implies --create-dir)
-cd
, --create-dir
If the output directory does not exist, create it.
-ns
, --no-codesign
Disable ad-hoc code signing.
A command may look like
% dylibbundler -od -b -x ./HelloWorld.app/Contents/MacOS/helloworld -d ./HelloWorld.app/Contents/libs/
If you want to create a universal binary by merging together two builds from PPC and Intel machines, you can ease it up by putting the ppc and intel libs in different directories, then to create the universal binary you only have to lipo the executable.
% dylibbundler -od -b -x ./HelloWorld.app/Contents/MacOS/helloworld
-d ./HelloWorld.app/Contents/libs-ppc/ -p @executable_path/../libs-ppc/
% dylibbundler -od -b -x ./HelloWorld.app/Contents/MacOS/helloworld
-d ./HelloWorld.app/Contents/libs-intel/ -p @executable_path/../libs-intel/
FAQs
Unknown package
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
Security News
Research
Socket researchers have discovered malicious npm packages targeting crypto developers, stealing credentials and wallet data using spyware delivered through typosquats of popular cryptographic libraries.
Security News
Socket's package search now displays weekly downloads for npm packages, helping developers quickly assess popularity and make more informed decisions.