Research
Security News
Malicious npm Package Targets Solana Developers and Hijacks Funds
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
github.com/iamolegga/enviper
Package enviper is a helper/wrapper for viper with the same API. It makes it possible to unmarshal config to struct considering environment variables.
Viper package doesn't consider environment variables while unmarshaling. Please, see: 188 and 761
Just wrap viper instance and use the same Unmarshal
method as you did before:
e := enviper.New(viper.New())
e.Unmarshal(&config)
package main
import (
"github.com/iamolegga/enviper"
"github.com/spf13/viper"
)
type barry struct {
Bar int `mapstructure:"bar"`
}
type bazzy struct {
Baz bool
}
type quxxy struct {
Qux string
}
type config struct {
Foo string
Barry barry
Barries map[string]barry
Bazzy bazzy `mapstructure:",squash"`
Quxxy *quxxy
}
// For example this kind of structure can be unmarshaled with next yaml:
// Foo: foo
// Barry:
// bar: 42
// Baz: true
// Barries:
// key1:
// Bar: 255
// key2:
// Bar: 256
// Quxxy:
// Qux: "lorem"
//
// And then it could be overriden by next env variables:
// FOO=foo
// BARRY_BAR=42
// BAZ=true
// BARRIES_KEY1_BAR=42
// QUXXY_QUX=ipsum
//
// Or with prefix:
// MYAPP_FOO=foo
// MYAPP_BARRY_BAR=42
// MYAPP_BAZ=true
// MYAPP_BARRIES_KEY1_BAR=42
// MYAPP_QUXXY_QUX=ipsum
func main() {
var c config
e := enviper.New(viper.New())
e.SetEnvPrefix("MYAPP")
e.AddConfigPath("/my/config/path")
e.SetConfigName("config")
e.Unmarshal(&c)
}
In case you want to use custom tag name (something different from mapstructure
), you have to set it explicitly via WithTagName
function.
The wrapper must know custom tag name in order to register all the env vars for viper so you can't just use DecoderConfigOption
.
Thanks to krak3n (issuecomment-399884438) and celian-garcia (issuecomment-626122696) for inspiring.
FAQs
Unknown package
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
Security News
Research
Socket researchers have discovered malicious npm packages targeting crypto developers, stealing credentials and wallet data using spyware delivered through typosquats of popular cryptographic libraries.
Security News
Socket's package search now displays weekly downloads for npm packages, helping developers quickly assess popularity and make more informed decisions.