Research
Security News
Malicious npm Package Targets Solana Developers and Hijacks Funds
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
github.com/leanlabsio/kanban
Minimum Install Requrements:
OS: kernel minimum 3.10 (centOS 7, Ubuntu 14.04)
Packages: git, curl
sudo yum -y install git, curl
The easiest way to deploy Leanlabs Kanban board is to use docker-compose. Install instructions here. Assuming you have installed Docker and docker-compose.
git clone https://gitlab.com/leanlabsio/kanban.git
cd kanban
Go to https://gitlab.com/profile/applications or your GitLab installation and register your application to get the application client ID and client secret key required for OAuth.
Where
Redirect url http[s]://{KANBAN_SERVER_HOSTNAME}/assets/html/user/views/oauth.html
Where
KANBAN_SERVER_HOSTNAME
| http[s]://{KANBAN_SERVER_HOSTNAME} - URL on which LeanLabs Kanban will be reachable [same as redirect url with out /assets/html...], required
KANBAN_SECURITY_SECRET
| Change this string to antyhing you like. This string is used to generate user auth tokens
KANBAN_GITLAB_URL
| http[s]://{gitlab.example.com:port} - Your GitLab host URL, required
KANBAN_GITLAB_CLIENT
| Your GitLab OAuth client application ID, required for OAuth to work. Git this from your gitlab server.
KANBAN_GITLAB_SECRET
| Your GitLab OAuth client secret key, required for OAuth to work. Git this from your gitlab server.
KANBAN_ENABLE_SIGNUP
| Wheter to enable sign up with user API token.
Then
docker-compose up -d
If you followed instructions from "Installation with Docker", then the easiest way to upgrade would be:
git pull
docker-compose up -d
You can view the changelog here
FAQs
Unknown package
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
Security News
Research
Socket researchers have discovered malicious npm packages targeting crypto developers, stealing credentials and wallet data using spyware delivered through typosquats of popular cryptographic libraries.
Security News
Socket's package search now displays weekly downloads for npm packages, helping developers quickly assess popularity and make more informed decisions.