Research
Security News
Malicious npm Package Targets Solana Developers and Hijacks Funds
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
github.com/ilyakaznacheev/roster
The simple service for a roster management.
This tiny service was built to manage rosters with very limited abilities. The API is described in API section.
Tools, libraries and approaches were chosen with a focus on production readiness.
There are some technical decisions made to bring more flexibility and scalability to the service. It may look overcomplicated, but there is extensibility and reliability behind the simplicity.
There are no frameworks due to simple infrastructure.
All core logic (request handlers) is covered with unit-tests. No need to check infrastructure and generated core, because it doesn't change so much, but really hard to test. DB and web layers are isolated.
The service is ready to run as a standalone microservice in any environment, e.g. K8s.
It is built with a closer look to 12-factor app principle, and can be easily integrated into 12-f infrastructure with small changes or additions.
The tool has no runtime dependencies, but some development tools which you may need to contribute:
go-swagger is a tool for automate code generation based on swagger.yml
schema.
Install on MacOS
brew install go-swagger
Install on Linux
echo "deb https://dl.bintray.com/go-swagger/goswagger-debian ubuntu main" | sudo tee -a /etc/apt/sources.list
mockery is a tool for automate code generation for testing mocks.
Install
go get github.com/vektra/mockery/.../
Installation as a Go package
go get -v -u https://github.com/ilyakaznacheev/roster
Installation as a git repo
git clone https://github.com/ilyakaznacheev/roster.git
There are several options. You can run the service as a standalone binary, but you should satisfy infrastructure requirements in this case. For more information run
go run cmd/roster/main.go -h
Note! There is no possibility to create a roster via API, so you need to initialize the database by your own.
But there are some more useful ways to run it preconfigured for you.
To start the service in a docker-compose, you need docker
and docker-compose
to be installed on your machine.
Then you can run
make docker/up
it will start to serve on localhost:8080
.
To shut it down run
make docker/down
The project is preconfigured to run on Heroku. You can clone the repo and connect your own Heroku app - it should start Dockerfile. For more information read my article.
API is tiny but powerful. For detailed information check swagger.yml
. For nice picture paste it into Swagger Editor.
Shortly you can do the following:
/api/register
- register a new API user/api/login
- get JWT token (you need it to make changes)/api/rosters
- get a list of rosters/api/rosters/{id}
- get certain roster/api/rosters/{id}/active
- get a roster with active players only/api/rosters/{id}/benched
- get a roster with benched players only/api/rosters/{id}/add_player
- add a new player/api/rosters/{id}/rearrange
- rearrange playersFAQs
Unknown package
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
Security News
Research
Socket researchers have discovered malicious npm packages targeting crypto developers, stealing credentials and wallet data using spyware delivered through typosquats of popular cryptographic libraries.
Security News
Socket's package search now displays weekly downloads for npm packages, helping developers quickly assess popularity and make more informed decisions.