Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
github.com/c2fo/vfS
Go library to generalize commands and behavior when interacting with various file systems.
The vfs library includes interfaces which allow you to interact with files and locations on various file systems in a generic way. Currently supported file systems:
These interfaces are composed of standard Go library interfaces, allowing for simple file manipulation within, and between the supported file systems.
At C2FO we have created a factory system that is integrated with our app configuration that allows for simply initializing the various locations we tend to do file work in. You can build your own similar system directly on top of the various file system implementations and the provided generic interfaces, or you can use the simple interface included in the vfs package. The usage examples below will detail this simple interface. We will eventually be providing a version of our factory as an example of how this library can be used in a more complex project.
A couple notes on configuration for this interface (vfssimple.NewFile and vfssimple.NewLocation):
OS X, Linux, and Windows:
glide install github.com/c2fo/vfs
import "github.com/c2fo/vfs/vfssimple"
// The following functions tell vfssimple we expect to handle a particular file system in subsequent calls to
// vfssimple.NewFile() and vfssimple.NewLocation
// Local files, ie: "file:///"
vfssimple.InitializeLocalFileSystem()
// Google Cloud Storage, ie: "gs://"
vfs.InitializeGSFileSystem()
// Amazon S3, ie: "s3://"
vfssimple.InitializeS3FileSystem(accessKeyId, secreteAccessKey, token)
// alternative to above for S3, if you've already initialized a client of interface s3iface.S3API
vfssimple.SetS3Client(client)
You can then use those file systems to initialize locations which you'll be referencing frequently, or initialize files directly
osFile, err := vfssimple.NewFile("file:///path/to/file.txt")
s3File, err := vfssimple.NewFile("s3://bucket/prefix/file.txt")
osLocation, err := vfssimple.NewLocation("file:///tmp")
s3Location, err := vfssimple.NewLocation("s3://bucket")
osTmpFile, err := osLocation.NewFile("anotherFile.txt") // file at /tmp/anotherFile.txt
With a number of files and locations between s3 and the local file system you can perform a number of actions without any consideration for the system's api or implementation details.
osFileExists, err := osFile.Exists() // true, nil
s3FileExists, err := s3File.Exists() // false, nil
err = osFile.CopyToFile(s3File) // nil
s3FileExists, err = s3File.Exists() // true, nil
movedOsFile, err := osFile.MoveToLocation(osLocation)
osFileExists, err = osFile.Exists() // false, nil (move actions delete the original file)
movedOsFileExists, err := movedOsFile.Exists() // true, nil
s3FileUri := s3File.URI() // s3://bucket/prefix/file.txt
s3FileName := s3File.Name() // file.txt
s3FilePath := s3File.Path() // /prefix/file.txt
// vfs.File and vfs.Location implement fmt.Stringer, returning x.URI()
fmt.Sprintf("Working on file: %s", s3File) // "Working on file: s3://bucket/prefix/file.txt"
Fork the project and clone it locally, then in the cloned directory...
glide install
go test $(glide novendor)
Brought to you by the Enterprise Pipeline team at C2FO:
John Judd - john.judd@c2fo.com
Jason Coble - @jasonkcoble - jason@c2fo.com
Chris Roush – chris.roush@c2fo.com
Distributed under the MIT license. See LICENSE
for more information.
git checkout -b feature/fooBar
)git commit -am 'Add some fooBar'
)git push origin feature/fooBar
)FAQs
Unknown package
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.