Research
Security News
Quasar RAT Disguised as an npm Package for Detecting Vulnerabilities in Ethereum Smart Contracts
Socket researchers uncover a malicious npm package posing as a tool for detecting vulnerabilities in Etherium smart contracts.
github.com/djbckr/gotk
This is a go (golang) library that allows you to have a
cross-platform UI using the Tcl/Tk library. Rather than interfacing
directly to a C library, this uses the wish
program when TK
is installed on your computer. OSX already has it installed; for Windows
and Linux, you'll need to install it. Information can be found
here
As noted, the interface between go and Tcl/Tk is through the wish
program. Your Go program sends commands to wish
, and when you want
information, such as the contents of an entry field, or a reaction
to a button click, wish
sends that information back to your Go program
via network sockets. As a result, there is no messing about with
unsafe memory management calling into C libraries.
Most examples of Tcl/Tk usage here
use languages that are dynamic. Tcl/Tk is dynamic as well. And of course
Go is not. The best concession I could come up with was to use chained
function calls that end with Exec()
for the dynamic pieces,
as can be seen in the gotk_test.go
file.
At this point, the library is strictly UI-centric. It does not support any of the Tcl commands, though you can send raw commands using this library if you want. The intent is to have Go create a UI, and the events (button clicks, primarily) will call Go functions.
For a quick example, see the gotk_test.go
file.
This is a work in progress, not ready for prime-time.
FAQs
Unknown package
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket researchers uncover a malicious npm package posing as a tool for detecting vulnerabilities in Etherium smart contracts.
Security News
Research
A supply chain attack on Rspack's npm packages injected cryptomining malware, potentially impacting thousands of developers.
Research
Security News
Socket researchers discovered a malware campaign on npm delivering the Skuld infostealer via typosquatted packages, exposing sensitive data.