Research
Security News
Malicious npm Package Targets Solana Developers and Hijacks Funds
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
github.com/pyroscope-io/otel-profiling-go
NOTE: This is an experimental package -- and will be officially supported in future versions of Pyroscope
The package provides means to integrate tracing with profiling. More specifically, a TracerProvider
implementation,
that annotates profiling data with span IDs: when a new trace span emerges, the tracer adds a profile_id
pprof tag
that points to the span. This makes it possible to filter out a profile of a particular trace span in Pyroscope.
You can find a full Jaeger example (with custom Jaeger UI) in the tracing/jaeger folder in the Pyroscope repository.
We also added functionality where each individual span is compared to a baseline of spans with similar properties and the diff can be shown in the UI:
For another example of what this package allows you to do you can see with Grafana the ability to link between logs, traces and profiles in the following video (source):
Note that the module does not control pprof
profiler itself – it still needs to be started for profiles to be
collected. This can be done either via runtime/pprof
package, or using the Pyroscope client.
By default, only the root span gets annotated (the first span created locally), this is done to circumvent the fact that the profiler records only the time spent on CPU. Otherwise, all the children profiles should be merged to get the full representation of the root span profile.
There are few limitations:
FAQs
Unknown package
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
Security News
Research
Socket researchers have discovered malicious npm packages targeting crypto developers, stealing credentials and wallet data using spyware delivered through typosquats of popular cryptographic libraries.
Security News
Socket's package search now displays weekly downloads for npm packages, helping developers quickly assess popularity and make more informed decisions.