Research
Security News
Malicious npm Package Targets Solana Developers and Hijacks Funds
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
github.com/carousell/Orion/builder
Orion-Builder is written in golang, please follow instructions on https://golang.org/doc/install to install, or you can also run
brew install golang
add the following lines to your ~/.profile
export GOPATH="$HOME/code/go"
export GOBIN="$GOPATH/bin"
export PATH="$GOBIN:$PATH"
export PATH="$HOME/.gotools:$PATH"
source your ~/.profile
source ~/.profile
then create the code dir
mkdir -p $GOPATH
we use govendor
to vendor package in Orion-Builder, install it by running
go get -u github.com/kardianos/govendor
another helpful tool to check for unupdated packages is Go-Package-Store
, install it by running
go get -u github.com/shurcooL/Go-Package-Store/cmd/Go-Package-Store
now clone this repo
mkdir -p $GOPATH/src/github.com/carousell/
git clone git@github.com:carousell/Orion-Builder.git $GOPATH/src/github.com/carousell/Orion-Builder
You need the following tools to better develop for go
go get -u github.com/golang/lint/golint
now you can build the package by using make build
for gRPC, you need to follow the following steps
get gRPC codebase
go get -u google.golang.org/grpc
install protobuf
brew install protobuf
install the protoc plugin for go
go get -u github.com/golang/protobuf/{proto,protoc-gen-go}
install the protoc plugin for orion
go get -u github.com/carousell/Orion/protoc-gen-orion
just run ./create.sh <service-name>
FAQs
Unknown package
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
Security News
Research
Socket researchers have discovered malicious npm packages targeting crypto developers, stealing credentials and wallet data using spyware delivered through typosquats of popular cryptographic libraries.
Security News
Socket's package search now displays weekly downloads for npm packages, helping developers quickly assess popularity and make more informed decisions.