
Research
Malicious npm Package Brand-Squats TanStack to Exfiltrate Environment Variables
A brand-squatted TanStack npm package used postinstall scripts to steal .env files and exfiltrate developer secrets to an attacker-controlled endpoint.
github.com/carousell/Orion/v2
Advanced tools
Orion is a small lightweight framework written around grpc/protobuf with the aim to shorten time to build microservices at Carousell.
It is derived from 'Framework' a small microservices framework written and used inside https://carousell.com, It comes with a number of sensible defaults such as zipkin tracing, hystrix, live reload of configuration, etc.
Follow the guide at https://github.com/carousell/Orion/blob/master/orion/README.md
Orion is written in golang, please follow instructions on https://golang.org/doc/install to install, or you can also run
brew install golang
or
sudo dnf install golang
Make sure you are on go 1.9 or later
add the following lines to your ~/.profile
export GOPATH="$HOME/code/go"
export GOBIN="$GOPATH/bin"
export PATH="$GOBIN:$PATH"
export PATH="$HOME/.gotools:$PATH"
source your ~/.profile
source ~/.profile
then create the code dir
mkdir -p $GOPATH
we use govendor to vendor package in Orion, install it by running
go get -u github.com/kardianos/govendor
another helpful tool to check for unupdated packages is Go-Package-Store, install it by running
go get -u github.com/shurcooL/Go-Package-Store/cmd/Go-Package-Store
now clone this repo
mkdir -p $GOPATH/src/github.com/carousell/
git clone git@github.com:carousell/Orion.git $GOPATH/src/github.com/carousell/Orion
You need the following tools to better develop for go
go get -u golang.org/x/lint/golint
now you can build the package by using make build
for gRPC, you need to follow the following steps
get gRPC codebase
go get -u google.golang.org/grpc
install protobuf
brew install protobuf
install the protoc plugin for go
go get -u github.com/golang/protobuf/{proto,protoc-gen-go}
install the protoc plugin for orion
go get -u github.com/carousell/Orion/protoc-gen-orion/v2
Orion is in use at production at Carousell and powers multiple (100+) services serving thousands of requests per second, we ensure all updates are backward compatible unless it involves a major bug or security issue.
This code is available under the following https://github.com/carousell/Orion/blob/master/LICENSE
FAQs
Unknown package
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A brand-squatted TanStack npm package used postinstall scripts to steal .env files and exfiltrate developer secrets to an attacker-controlled endpoint.

Research
Compromised SAP CAP npm packages download and execute unverified binaries, creating urgent supply chain risk for affected developers and CI/CD environments.

Company News
Socket has acquired Secure Annex to expand extension security across browsers, IDEs, and AI tools.