
Research
Malicious npm Package Brand-Squats TanStack to Exfiltrate Environment Variables
A brand-squatted TanStack npm package used postinstall scripts to steal .env files and exfiltrate developer secrets to an attacker-controlled endpoint.
github.com/explodingcamera/fantasymarket-api
Advanced tools
We are creating a stock market simulation, where the user can invest in-game currency in a simulated market completely separated from the real world. By providing custom events that pop up randomly and alter the course of our stocks, coupled with a market that never sleeps, we are presenting a fun and fast-paced introduction into the stock market. This is the repository for the backend, the corresponding frontend can be found here.
fantasymarket-app ├── api # rest api service ├── database # database service ├── game # game service └── utils # utility functions
$ task install-linter after installing task.$ task install-bindata after installing task.NOTE: Due to some changes in gcc 10, you might see some warnings because of the sqlite bindings we use. This won't cause any issues.
$ git clone https://github.com/fantasymarket/fantasymarket-app.git
$ cd fantasymarket-app
VSCode with the official GO extension or goland
With Task installed:
$ task test # run tests
$ task lint # lint code
Alternative:
$ go test ./...



After installing all the requirements, start the program by running $ go run main.go.
The console should output information about the status of the program:
INF successfully connected to the database
INF successfully started the game loop
INF successfully started the http server address=localhost:5000
It will then load the last tick from the Database before printing it and the ingame time:
DBG running tick date="2020-01-01 00:00:00 +0000 UTC" tick=2
After this setup, the program prints the indices from the two currently implemented stocks Google and Apple. This is done every 10 seconds, like this:
DBG updated stock index=60032 name=GOOG
DBG updated stock index=60024 name=APPL
The corresponding instructions for running the frontend can be found here.
FAQs
Unknown package
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A brand-squatted TanStack npm package used postinstall scripts to steal .env files and exfiltrate developer secrets to an attacker-controlled endpoint.

Research
Compromised SAP CAP npm packages download and execute unverified binaries, creating urgent supply chain risk for affected developers and CI/CD environments.

Company News
Socket has acquired Secure Annex to expand extension security across browsers, IDEs, and AI tools.