Research
Security News
Malicious npm Package Targets Solana Developers and Hijacks Funds
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
github.com/flatcar-linux/container-linux-config-transpiler
The Config Transpiler ("ct" for short) is the utility responsible for transforming a human-friendly Container Linux Config into a JSON file. This resulting file can be provided to a Container Linux machine when it first boots to provision the machine.
NOTE: This tool is for Container Linux, not Fedora CoreOS. See FCCT for the Fedora CoreOS equivalent.
If you're looking to begin writing configs for your Container Linux machines, check out the getting started documentation.
The configuration documentation is a comprehensive resource specifying what options can be in a Container Linux Config.
For a more in-depth view of ct and why it exists, take a look at the Overview document.
Please use the bug tracker to report bugs.
There are plenty of small, self-contained examples in the documentation.
brew install coreos-ct
The easiest way to get started using ct is to download one of the binaries from the releases page on GitHub.
One can use the following script to download and verify the signature of Config Transpiler:
# Specify Config Transpiler version
CT_VER=v0.6.1
# Specify Architecture
# ARCH=aarch64 # ARM's 64-bit architecture
ARCH=x86_64
# Specify OS
# OS=apple-darwin # MacOS
# OS=pc-windows-gnu.exe # Windows
OS=unknown-linux-gnu # Linux
# Specify download URL
DOWNLOAD_URL=https://github.com/flatcar/container-linux-config-transpiler/releases/download
# Remove previous downloads
rm -f /tmp/ct-${CT_VER}-${ARCH}-${OS} /tmp/ct-${CT_VER}-${ARCH}-${OS}.asc /tmp/coreos-app-signing-pubkey.gpg
# Download Config Transpiler binary
curl -L ${DOWNLOAD_URL}/${CT_VER}/ct-${CT_VER}-${ARCH}-${OS} -o /tmp/ct-${CT_VER}-${ARCH}-${OS}
chmod u+x /tmp/ct-${CT_VER}-${ARCH}-${OS}
# Download and import CoreOS application signing GPG key
curl https://coreos.com/dist/pubkeys/app-signing-pubkey.gpg -o /tmp/coreos-app-signing-pubkey.gpg
gpg2 --import --keyid-format LONG /tmp/coreos-app-signing-pubkey.gpg
# Download and import CoreOS application signing GPG key if it has not already been imported
curl -L ${DOWNLOAD_URL}/${CT_VER}/ct-${CT_VER}-${ARCH}-${OS}.asc -o /tmp/ct-${CT_VER}-${ARCH}-${OS}.asc
gpg2 --verify /tmp/ct-${CT_VER}-${ARCH}-${OS}.asc /tmp/ct-${CT_VER}-${ARCH}-${OS}
To build from source you'll need to have the go compiler installed on your system.
git clone --branch v0.8.0 https://github.com/flatcar/container-linux-config-transpiler
cd container-linux-config-transpiler
make
The ct
binary will be placed in ./bin/
.
Note: Review releases for new branch versions.
FAQs
Unknown package
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
Security News
Research
Socket researchers have discovered malicious npm packages targeting crypto developers, stealing credentials and wallet data using spyware delivered through typosquats of popular cryptographic libraries.
Security News
Socket's package search now displays weekly downloads for npm packages, helping developers quickly assess popularity and make more informed decisions.