
Research
Malicious npm Package Brand-Squats TanStack to Exfiltrate Environment Variables
A brand-squatted TanStack npm package used postinstall scripts to steal .env files and exfiltrate developer secrets to an attacker-controlled endpoint.
github.com/desertbit/timer
Advanced tools
This is a lightweight timer implementation which is a drop-in replacement for Go's Timer. Reset behaves as one would expect and drains the timer.C channel automatically. The core design of this package is similar to the original runtime timer implementation.
These two lines are equivalent except for saving some garbage:
t.Reset(x)
t := timer.NewTimer(x)
See issues:
Quote from the Timer Go doc reference:
Reset changes the timer to expire after duration d. It returns true if the timer had been active, false if the timer had expired or been stopped.
To reuse an active timer, always call its Stop method first and—if it had expired—drain the value from its channel. For example: [...] This should not be done concurrent to other receives from the Timer's channel.
Note that it is not possible to use Reset's return value correctly, as there is a race condition between draining the channel and the new timer expiring. Reset should always be used in concert with Stop, as described above. The return value exists to preserve compatibility with existing programs.
package main
import (
"log"
"time"
)
func main() {
start := time.Now()
// Start a new timer with a timeout of 1 second.
timer := time.NewTimer(1 * time.Second)
// Wait for 2 seconds.
// Meanwhile the timer fired and filled the channel.
time.Sleep(2 * time.Second)
// Reset the timer. This should act exactly as creating a new timer.
timer.Reset(1 * time.Second)
// However this will fire immediately, because the channel was not drained.
// See issue: https://github.com/golang/go/issues/11513
<-timer.C
if int(time.Since(start).Seconds()) != 3 {
log.Fatalf("took ~%v seconds, should be ~3 seconds\n", int(time.Since(start).Seconds()))
}
}
package main
import "time"
const (
keepaliveInterval = 2 * time.Millisecond
)
var (
resetC = make(chan struct{}, 1)
)
func main() {
go keepaliveLoop()
// Sample routine triggering the reset.
// Example: this could be due to incoming peer requests and
// a keepalive check should be reset to the max keepalive timeout.
for i := 0; i < 1000; i++ {
time.Sleep(time.Millisecond)
resetKeepalive()
}
}
func resetKeepalive() {
// Don't block if there is already a reset request.
select {
case resetC <- struct{}{}:
default:
}
}
func keepaliveLoop() {
t := time.NewTimer(keepaliveInterval)
for {
select {
case <-resetC:
time.Sleep(3 * time.Millisecond) // Simulate some reset work...
t.Reset(keepaliveInterval)
case <-t.C:
ping()
t.Reset(keepaliveInterval)
}
}
}
func ping() {
panic("ping must not be called in this example")
}
FAQs
Unknown package
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A brand-squatted TanStack npm package used postinstall scripts to steal .env files and exfiltrate developer secrets to an attacker-controlled endpoint.

Research
Compromised SAP CAP npm packages download and execute unverified binaries, creating urgent supply chain risk for affected developers and CI/CD environments.

Company News
Socket has acquired Secure Annex to expand extension security across browsers, IDEs, and AI tools.