Research
Security News
Malicious npm Package Targets Solana Developers and Hijacks Funds
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
github.com/cycloidio/raws
Raws is a golang project helping to get information from AWS.
It currently provides simplicity - one package vs multitude in AWS - as well as multi-region management - all calls are done for each selected region(s). Region's parameter also supports globbing, thus allowing to fetch data from all eu with: 'eu-*' or all eu-west with 'eu-west-*'
Currently only a couple of the most used information is gathered, but adding extra calls should not be complicated, as they all have the same logic.
Any contributions are welcome!
IMPORTANT we are still experimenting the usage of this library, hence the public interface isn't stable as we have to see that the methods signatures fulfill the main goal of the library which is to simplify the AWS SDK to gather information. Because of this, the repo contains tags which define each version using Semantic Versioning convention.
To get started, you can download/include the library to your code and use it like so:
func main() {
var config *aws.Config = nil
var accessKey string = "xxxxxxxxxxxxxxx"
var secretKey string = "xxxxxxxxxxxxxxxxxxxxxxxxxxx"
var region []string = []string{"eu-*"}
var ctx = context.Background()
// Create a reader
c, err := raws.NewAWSReader(ctx, accessKey, secretKey, region, config)
if err != nil {
fmt.Printf("Error while getting NewConnector: %s\n", err.Error())
return
}
// Start making calls
// Errors are intentionally ignored in this example,
// no inputs are provided to those calls, even though one could.
elbs, _ := c.GetLoadBalancersV2(ctx, nil)
fmt.Println(elbs)
instances, _ := c.GetInstances(ctx, nil)
fmt.Println(instances)
vpcs, _ := c.GetVpcs(ctx, nil)
fmt.Println(vpcs)
return
}
We use a custom generation tool located on cmd/main.go
which basically uses a list of function definitions (cmd/functions.go
) to generate the wrappers for those,
if you want to add a call to the AWS API you have to add it to that list and if the implementation fits the template it'll be automatically generated/implemented.
If it does not fit the template you'll have to implement it manually, an example is the s3downloader.go
.
To generate the code just run make generate
.
That's it! Nothing more, nothing less.
By default the library only returns data that belongs to you, therefore snapshots, AMI, etc are only the one that you owned and not all available objects.
This could be fixed later on depending on the needs.
Because the library currently simply make the call as a forwarder, it does not provide more complex calls, to return more complex data. Due to that, there are also elements to keep in mind, some calls relative to load balancer, or RDS return only the objects without tags, other calls need to be done to get those tags per resource.
Please see LICENSE.
FAQs
Unknown package
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
Security News
Research
Socket researchers have discovered malicious npm packages targeting crypto developers, stealing credentials and wallet data using spyware delivered through typosquats of popular cryptographic libraries.
Security News
Socket's package search now displays weekly downloads for npm packages, helping developers quickly assess popularity and make more informed decisions.