
Research
/Security News
9 Malicious NuGet Packages Deliver Time-Delayed Destructive Payloads
Socket researchers discovered nine malicious NuGet packages that use time-delayed payloads to crash applications and corrupt industrial control systems.
github.com/guilhermecoutinho/concurrent-generic-heap
Advanced tools
This project is study oriented. The goal was to implement a generic data type and thread-safe heap to hopefully understand better the heap data structure as well as solving underlying problems with concurrency.
The final implementation consists of a unsafe heap and a safe heap which is kinda of a wrapper of the unsafe version.
caveat: Although any data type can be used, all elements pushed to the heap must be of the same type.
3 examples of different heaps and how they are instantiated:
CommonCode
preallocatedSize := 10
minHeap := heap.NewHeap(preallocatedSize, func(a, b interface{}) bool {
return a.(int) < b.(int)
})
maxHeap := heap.NewHeap(preallocatedSize, func(a, b interface{}) bool {
return a.(int) > b.(int)
})
stringHeap := heap.NewHeap(preallocatedSize, func(a, b interface{}) bool {
return a.(string) > b.(string)
})
The implementation also contains a nice visualization of the heap. For example, after 10 random words pushed to a lexicographic Heap:
understood
├─── turkey
│ ├─── repair
│ │ ├─── brush
│ │ ├─── loving
│ ├─── homeless
│ │ ├─── frantic
├─── thin
│ ├─── actually
│ ├─── stroke
The chosen design was to use channels to issue commands to a centralized goroutine that would call the correct unsafe operation in a safe way. Its like this centralized goroutine is listening to heap operation requests. To return values from it, inside the request tehres another channel that will serve as a callback for the result of operations.
Interesting point: One interesting thing I noticed, is that some methods are essentially unsafe in the scope of the caller and other methods are unsafe only in the scope of the heap instance. My current design choice was to keep the API simple, so that the user of the safe-heap doesnt need to know what is safe/unsafe in their scope.
For example:
Im curious to see how other libs threat this, if they just leave that problem to good documentation or enforce the caller to threat these things somehow.
This is how we centralize the execution of the internal operations (keeping a dedicated channel for every operation):
func (s *SafeHeapImpl) startListening() {
for {
select {
case push := <-s.pushChan:
s.heap.Push(push)
case req := <-s.popChan:
val, err := s.heap.Pop()
req.result <- operationResult{val: val, err: err}
case req := <-s.peekChan:
val, err := s.heap.Peek()
req.result <- operationResult{val: val, err: err}
case req := <-s.removeChan:
err := s.heap.Remove(req.val)
req.result <- operationResult{val: req.val, err: err}
}
}
}
FAQs
Unknown package
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Socket researchers discovered nine malicious NuGet packages that use time-delayed payloads to crash applications and corrupt industrial control systems.

Security News
Socket CTO Ahmad Nassri discusses why supply chain attacks now target developer machines and what AI means for the future of enterprise security.

Security News
Learn the essential steps every developer should take to stay secure on npm and reduce exposure to supply chain attacks.