Research
Security News
Malicious npm Package Targets Solana Developers and Hijacks Funds
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
github.com/knadh/listmonk
listmonk is a standalone, self-hosted, newsletter and mailing list manager. It is fast, feature-rich, and packed into a single binary. It uses a PostgreSQL database as its data store.
Visit listmonk.app
The latest image is available on DockerHub at listmonk/listmonk:latest
. Use the sample docker-compose.yml to run listmonk and Postgres DB with docker-compose as follows:
mkdir listmonk-demo
sh -c "$(curl -sSL https://raw.githubusercontent.com/knadh/listmonk/master/install-demo.sh)"
The demo does not persist Postgres after the containers are removed. DO NOT use this demo setup in production.
docker-compose up db
to run the Postgres DB.docker-compose run --rm app ./listmonk --install
to setup the DB (or --upgrade
to upgrade an existing DB)docker-compose up app
and visit http://localhost:9000
.More information on docs.
./listmonk --new-config
to generate config.toml. Then, edit the file../listmonk --install
to setup the Postgres DB (or --upgrade
to upgrade an existing DB. Upgrades are idempotent and running them multiple times have no side effects)../listmonk
and visit http://localhost:9000
.Using the Nginx buildpack can be used to deploy listmonk on Heroku and use Nginx as a proxy to setup basicauth. This one-click Heroku deploy button provides an automated default deployment.
Please note that configuration options must be set using environment configuration variables.
listmonk is a free and open source software licensed under AGPLv3. If you are interested in contributing, refer to the developer setup. The backend is written in Go and the frontend is Vue with Buefy for UI.
listmonk is licensed under the AGPL v3 license.
FAQs
Unknown package
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
Security News
Research
Socket researchers have discovered malicious npm packages targeting crypto developers, stealing credentials and wallet data using spyware delivered through typosquats of popular cryptographic libraries.
Security News
Socket's package search now displays weekly downloads for npm packages, helping developers quickly assess popularity and make more informed decisions.