
Research
Namastex.ai npm Packages Hit with TeamPCP-Style CanisterWorm Malware
Malicious Namastex.ai npm packages appear to replicate TeamPCP-style Canister Worm tradecraft, including exfiltration and self-propagation.
github.com/mstetson/sqldata
Advanced tools
This package is not an ORM, but meets a similar need. Its performance is competitive with using database/sql directly, at least if you use prepared statements. It provides conveniences for writing queries, passing arguments, and scanning results based on data structures.
This package is FROZEN and should probably not be used in new work. Everything here is functional, but after using this system in production for several years, I see too many warts. The template language is too specialized and too difficult to extend. The SQLer concept is not quite right.
On the other hand, I like using this package better than any other database access method I've used – in Go or otherwise. I just think it needs another iteration. I have much of the design of the next iteration done, but I haven't had time to finish implementing it yet. It will not be API-compatible with this package.
I do not intend to make any further changes to this package. When I have the replacement ready, I'll reference it here. If anyone besides me is using this, please contact me.
go get github.com/mstetson/sqldata
Usage is intended to be much like database/sql. See godoc for details.
type Person struct {
ID int64
Name string
City string
State string
}
var Person p
err := sqldata.QueryRow(db, `select {{.}} from Persons where ID={{$1}}`, &p, 5)
if err != nil { panic(err) }
This software is released into the public domain. See LICENSE for details.
Thanks to SchoolsPLP, LLC for funding part of the work and allowing this code to be released freely.
FAQs
Unknown package
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Malicious Namastex.ai npm packages appear to replicate TeamPCP-style Canister Worm tradecraft, including exfiltration and self-propagation.

Product
Explore exportable charts for vulnerabilities, dependencies, and usage with Reports, Socket’s new extensible reporting framework.

Product
Socket for Jira lets teams turn alerts into Jira tickets with manual creation, automated ticketing rules, and two-way sync.