
Research
Malicious npm Package Brand-Squats TanStack to Exfiltrate Environment Variables
A brand-squatted TanStack npm package used postinstall scripts to steal .env files and exfiltrate developer secrets to an attacker-controlled endpoint.
github.com/codegangsta/cli
Advanced tools
cli is a simple, fast, and fun package for building command line apps in Go. The goal is to enable developers to write fast and distributable command line applications in an expressive way.
Usage documentation for v1 is available at the docs
site or in-tree at
./docs/v1/manual.md
Make sure you have a working Go environment. Go version 1.18+ is supported.
cli is tested against multiple versions of Go on Linux, and against the latest released version of Go on OS X and Windows. For full details, see ./.github/workflows/cli.yml.
You can use the following build tags:
urfave_cli_no_docsWhen set, this removes ToMarkdown and ToMan methods, so your application
won't be able to call those. This reduces the resulting binary size by about
300-400 KB (measured using Go 1.18.1 on Linux/amd64), due to less dependencies.
v1 releases$ go get github.com/urfave/cli
...
import (
"github.com/urfave/cli"
)
...
FAQs
Unknown package
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A brand-squatted TanStack npm package used postinstall scripts to steal .env files and exfiltrate developer secrets to an attacker-controlled endpoint.

Research
Compromised SAP CAP npm packages download and execute unverified binaries, creating urgent supply chain risk for affected developers and CI/CD environments.

Company News
Socket has acquired Secure Annex to expand extension security across browsers, IDEs, and AI tools.