
Research
Security News
Lazarus Strikes npm Again with New Wave of Malicious Packages
The Socket Research Team has discovered six new malicious npm packages linked to North Korea’s Lazarus Group, designed to steal credentials and deploy backdoors.
github.com/garylouisstewart/ms-mvc
a rework of the MVC architecture, this is my attempt to finish this course to better my understanding of microservices.
This application differs from the one here: https://github.com/federicoleon/golang-microservices/tree/master/mvc
as it uses a different data type and structs to describe elements in the periodic table.
With thanks to @FedericoLeon https://github.com/federicoleon
for providing the course on udemy that inspired me to rework this application.
A few examples of requests that are sent to the application using curl, or you can use Postman to do these queries too.
go run main.go
# starting the application
go run main.go
[GIN-debug] [WARNING] Creating an Engine instance with the Logger and Recovery middleware already attached.
[GIN-debug] [WARNING] Running in "debug" mode. Switch to "release" mode in production.
- using env: export GIN_MODE=release
- using code: gin.SetMode(gin.ReleaseMode)
[GIN-debug] GET /elements/:element_id --> github.com/GaryLouisStewart/ms-mvc/controllers.GetElement (3 handlers)
[GIN-debug] [WARNING] You trusted all proxies, this is NOT safe. We recommend you to set a value.
Please check https://pkg.go.dev/github.com/gin-gonic/gin#readme-don-t-trust-all-proxies for details.
[GIN-debug] Listening and serving HTTP on :8080
curl <myendpoint>:<port>/<path>/<id>
# running a curl request against the api with the wrong element id
curl localhost:8080/elements/111
{"message":"element 111 does not exist","status":404,"code":"not_found"}
curl <myendpoint>:<port>/<path>/<id>
# running a curl request against the api to get an element that exists
curl localhost:8080/elements/1
{"id":1,"name":"Hydrogen","atomic_mass":1.00784,"melting_point":-259.2,"boiling_point":-252.9,"discovery_date":1766}
# running a curl request to get xml format back from the api instead of json
curl localhost:8080/elements/1 -H "Accept:application/xml"
<Element><Id>1</Id><Name>Hydrogen</Name><AtomicMass>1.00784</AtomicMass><MeltingPoint>-259.2</MeltingPoint><BoilingPoint>-252.9</BoilingPoint><DiscoveryDate>1766</DiscoveryDate></Element>
curl <myendpoint>:<port>/<path>/<id> -v
# debugging requests to the api using curl
curl localhost:8080/elements/1 -v
* Trying 127.0.0.1:8080...
* Connected to localhost (127.0.0.1) port 8080 (#0)
> GET /elements/1 HTTP/1.1
> Host: localhost:8080
> User-Agent: curl/7.79.1
> Accept: */*
>
* Mark bundle as not supporting multiuse
< HTTP/1.1 200 OK
< Content-Type: application/json; charset=utf-8
< Date: Sun, 18 Sep 2022 13:18:07 GMT
< Content-Length: 116
<
* Connection #0 to host localhost left intact
{"id":1,"name":"Hydrogen","atomic_mass":1.00784,"melting_point":-259.2,"boiling_point":-252.9,"discovery_date":1766}
Finally, a diagram of the intended setup of this application.
FAQs
Unknown package
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
The Socket Research Team has discovered six new malicious npm packages linked to North Korea’s Lazarus Group, designed to steal credentials and deploy backdoors.
Security News
Socket CEO Feross Aboukhadijeh discusses the open web, open source security, and how Socket tackles software supply chain attacks on The Pair Program podcast.
Security News
Opengrep continues building momentum with the alpha release of its Playground tool, demonstrating the project's rapid evolution just two months after its initial launch.