Research
Security News
Malicious npm Package Targets Solana Developers and Hijacks Funds
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
github.com/ctdk/schob
Schob is a client for "shovey", a mechanism for pushing jobs to client nodes. Currently it's specific to goiardi, but a more general implementation is planned.
Running schob requires a goiardi server (both to send jobs to the schob client, and for the schob client to send reports to) and serf running with the goiardi server and on every client node that will run shovey jobs.
The knife-shove
plugin from https://github.com/ctdk/knife-shove or rubygems is
required to submit and administer shovey jobs.
Schob has the following golang dependencies outside of the standard library:
go-flags, toml, logger, the go-chef chef library, serf, go-uuid, and the
chefcrypto library from goiardi (only for tests). The easiest way to install
these dependencies is to include the -t
flag when using go get
to install
schob.
The easiest way to install schob is with the shovey-jobs cookbook, located at https://github.com/ctdk/shovey-jobs. At the moment it only supports Debian, though, so for now installing on non-Debian platforms will have to install schob by hand. If you already have a binary you can skip to number 2.
go get -t github.com/ctdk/schob
go install github.com/ctdk/schob Alternately, if you downloaded a precompiled binary, put that binary somewhere in your PATH.
test/whitelist.json
for guidance.test/schob-example.conf
, or it can use the following command line options: -v, --version Print version info.
-V, --verbose Show verbose debug information. Repeat for more
verbosity.
-c, --config= Specify a configuration file.
-L, --log-file= Log to this file.
-s, --syslog Use syslog for logging. Incompatible with
-L/--log-file.
-e, --endpoint= Server endpoint
-n, --node-name= This node's name
-k, --key-file= Path to node client private key
-m, --time-slew= Time difference allowed between the node's clock and
the time sent in the serf command from the server.
Formatted like 5m, 150s, etc. Defaults to 15m.
-w, --whitelist= Path to JSON file containing whitelisted commands
-t, --run-timeout= The time, in minutes, to wait before stopping a job.
Separate from the timeout set from the server, this is
a fallback. Defaults to 45 minutes.
-p, --sign-pub-key= Path to public key used to verify signed requests from
the server.
--serf-addr= IP anddress and port to use for RPC communication with
the serf agent. Defaults to 127.0.0.1:7373.
-q, --queue-save-file= File to save running job status to recover jobs that
didn't finish if schob is suddenly shut down without a
chance to clean up.
Options specified on the command line override options in the config file. A
typical command line invocation of schob looks like schob -VVVV -e http://chef-server.local:4545 -n node-name.local -k /path/to/node.key -w /path/to/schob/test/whitelist.json -p /path/to/public.key --serf-addr=127.0.0.1:7373
.
Once schob is running on a node, run jobs on it with the knife-shove
plugin.
The full documentation for that can be found at
https://github.com/ctdk/knife-shove, but here's a cheat sheet:
To start a job:
knife goiardi start node1, node2,...
To start a job on all nodes in the webapp role, where 90% of the nodes must be up:
knife goiardi job start -quorum 90% 'chef-client' --search 'role:webapp'
To see a job's status:
knife goiardi job status
To get detailed information on a job on one node:
knife goiardi job info
To stream a running job:
knife goiardi job stream
To cancel a job:
knife goiardi job cancel
To get a node's status:
knife goiardi node status
add_component_x
)Jeremy Bingham (jbingham@gmail.com)
Copyright 2014, Jeremy Bingham
Schob is licensed under the Apache 2.0 License. See the LICENSE file for details.
"Schob" is German for "shoved".
FAQs
Unknown package
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
Security News
Research
Socket researchers have discovered malicious npm packages targeting crypto developers, stealing credentials and wallet data using spyware delivered through typosquats of popular cryptographic libraries.
Security News
Socket's package search now displays weekly downloads for npm packages, helping developers quickly assess popularity and make more informed decisions.