Security News
The Risks of Misguided Research in Supply Chain Security
Snyk's use of malicious npm packages for research raises ethical concerns, highlighting risks in public deployment, data exfiltration, and unauthorized testing.
github.com/mattermost/community-continuous-profiling
Mattermost community continuous profiling tool is a microservice designed to work as part of a k8s cronjob that runs cpu and memory profiles for Mattermost community (or any other Mattermost installation) and posts in a Mattermost channel.
The following environment variables need to be exported for the microservice to work:
UPLOAD_API_URL:
This is the API url that should be used for the profiling attachment uploads. For example http://community:8065/api/v4/files
. More information on Mattermost files API call can be found here.
POST_API_URL:
This is the API url that should be used for the profiling attachment posts. For example http://community:8065/api/v4/posts
. More information on Mattermost posts API call can be found here.
MATTERMOST_DEPLOYMENTS:
The k8s deployments that profiling will be run against their pods. For example community, community-release
MATTERMOST_NAMESPACE: The namespace of the Mattermost deployments. Each profiling job can run against one namespace only.
PROFILING_TIME:
How long the CPU profiling should run for. For example 30
for 30 seconds.
CHANNEL_ID: The ID of the channel that the microservice should post the profiles. It is best to keep this in a k8s secret.
TOKEN: The Token for the Mattermost Bot that will authenticate and upload/post the profile attachments. It is best to keep this in a k8s secret. More information on Mattermost bots can be found here.
DEVELOPER_MODE(Optional): When set to true local k8s config is used for developing purposes
FAQs
Unknown package
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Snyk's use of malicious npm packages for research raises ethical concerns, highlighting risks in public deployment, data exfiltration, and unauthorized testing.
Research
Security News
Socket researchers found several malicious npm packages typosquatting Chalk and Chokidar, targeting Node.js developers with kill switches and data theft.
Security News
pnpm 10 blocks lifecycle scripts by default to improve security, addressing supply chain attack risks but sparking debate over compatibility and workflow changes.