Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
github.com/explodingcamera/fantasymarket-api
We are creating a stock market simulation, where the user can invest in-game currency in a simulated market completely separated from the real world. By providing custom events that pop up randomly and alter the course of our stocks, coupled with a market that never sleeps, we are presenting a fun and fast-paced introduction into the stock market. This is the repository for the backend, the corresponding frontend can be found here.
fantasymarket-app ├── api # rest api service ├── database # database service ├── game # game service └── utils # utility functions
$ task install-linter
after installing task.$ task install-bindata
after installing task.NOTE: Due to some changes in gcc 10, you might see some warnings because of the sqlite bindings we use. This won't cause any issues.
$ git clone https://github.com/fantasymarket/fantasymarket-app.git
$ cd fantasymarket-app
VSCode with the official GO extension or goland
With Task
installed:
$ task test # run tests
$ task lint # lint code
Alternative:
$ go test ./...
After installing all the requirements, start the program by running $ go run main.go
.
The console should output information about the status of the program:
INF successfully connected to the database
INF successfully started the game loop
INF successfully started the http server address=localhost:5000
It will then load the last tick from the Database before printing it and the ingame time:
DBG running tick date="2020-01-01 00:00:00 +0000 UTC" tick=2
After this setup, the program prints the indices from the two currently implemented stocks Google and Apple. This is done every 10 seconds, like this:
DBG updated stock index=60032 name=GOOG
DBG updated stock index=60024 name=APPL
The corresponding instructions for running the frontend can be found here.
FAQs
Unknown package
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.