Security News
The Risks of Misguided Research in Supply Chain Security
Snyk's use of malicious npm packages for research raises ethical concerns, highlighting risks in public deployment, data exfiltration, and unauthorized testing.
github.com/disaccord/beelzebub
A client for Discord's HTTP REST API.
Beelzebub draws inspiration from skwair/harmony in terms of design.
Discord resources that are instanced and scoped to an ID, or more, live in their own packages, which can be found in the flies
directory. Each resource can be created with its respective method (e.g., Guild(), User(), etc) found on the main Devil
type.
Some resources do not have a respective subpackage. One such instance of this is Emoji, as they are scoped to a Guild. So to perform operations on an Emoji, one would first need to create a Guild resource (henceforth "Fly" (because Beelzebub, get it?)) with its respective factory, and then perform whatever operations needed.
You may have noticed there are no tests of any kind in this package. Perhaps controversially, due to the nature of what Beelzebub does, I've opted to omit tests. The consequences of this decision are noted, but I'm going to roll with the punches. If you have the willpower, time, and/or patience to write unit tests, by all means, go ahead and PR it.
FAQs
Unknown package
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Snyk's use of malicious npm packages for research raises ethical concerns, highlighting risks in public deployment, data exfiltration, and unauthorized testing.
Research
Security News
Socket researchers found several malicious npm packages typosquatting Chalk and Chokidar, targeting Node.js developers with kill switches and data theft.
Security News
pnpm 10 blocks lifecycle scripts by default to improve security, addressing supply chain attack risks but sparking debate over compatibility and workflow changes.