Research
Security News
Malicious npm Package Targets Solana Developers and Hijacks Funds
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
github.com/google/gousb
The gousb package is an attempt at wrapping the libusb library into a Go-like binding.
Supported platforms include:
This is the release 2.0 of the package github.com/kylelemons/gousb. Its API is not backwards-compatible with version 1.0. As of 2017-07-13 the 2.0 API is considered stable and 1.0 is deprecated.
The documentation can be viewed via local godoc or via the excellent godoc.org:
You must first install libusb-1.0. This is pretty straightforward on linux and darwin. The cgo package should be able to find it if you install it in the default manner or use your distribution's package manager. How to tell cgo how to find one installed in a non-default place is beyond the scope of this README.
Note: If you are installing this on darwin, you will probably need to run fixlibusb_darwin.sh /usr/local/lib/libusb-1.0/libusb.h
because of an LLVM incompatibility. It shouldn't break C programs, though I haven't tried it in anger.
The gousb project provides a simple but useful example: lsusb. This binary will list the USB devices connected to your system and various interesting tidbits about them, their configurations, endpoints, etc. To install it, run the following command:
go get -v github.com/google/gousb/lsusb
If you installed the lsusb example, both libraries below are already installed.
Installing the primary gousb package is really easy:
go get -v github.com/google/gousb
There is also a usbid
package that will not be installed by default by this command, but which provides useful information including the human-readable vendor and product codes for detected hardware. It's not installed by default and not linked into the gousb
package by default because it adds ~400kb to the resulting binary. If you want both, they can be installed thus:
go get -v github.com/google/gousb{,/usbid}
You'll need:
Make sure the libusb-1.0.pc
pkg-config file from libusb was installed
and that the result of the pkg-config --cflags libusb-1.0
command shows the
correct include path for installed libusb.
After that you can continue with instructions for lsusb/gousb above.
Contributing to this project will require signing the Google CLA. This is the same agreement that is required for contributing to Go itself, so if you have already filled it out for that, you needn't fill it out again.
FAQs
Unknown package
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
Security News
Research
Socket researchers have discovered malicious npm packages targeting crypto developers, stealing credentials and wallet data using spyware delivered through typosquats of popular cryptographic libraries.
Security News
Socket's package search now displays weekly downloads for npm packages, helping developers quickly assess popularity and make more informed decisions.