Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
github.com/robocup-ssl/ssl-match-stats
A tool that generates statistics from official SSL log files.
You need to install following dependencies first:
Use go get to install all packages / executables:
go get -u github.com/RoboCup-SSL/ssl-match-stats/...
The executables are installed to your $GOPATH/bin folder. If you have it on your $PATH, you can directly run them. Else, switch to this folder first.
The ssl-match-stats
command will generate the statistics into an intermediate data structure match-stats.{json|bin}
from which they can be exported. This must be done per tournament and division.
The command takes a list of log files as input:
ssl-match-stats *.log.gz
The generated statistics can be exported into CSV files for further processing,
for example with a spreadsheet software or Matlab.
The ssl-match-stats-csv
command will read the match-stats.bin
protobuf file
from the current folder and produces a set of CSV files:
ssl-match-stats-csv
The generated statistics can be exported into a PostgreSQL database (other DBs not yet tested). This is useful if you want to apply some BI (Business Intelligence) application on the data.
See Setup for Match Stats DB for instructions on setting up the database.
See Setup for Metabase for instructions on setting up Metabase, an open-source BI software.
The command requires some parameters:
ssl-match-stats-db -sqlDbSource postgres://user:password@host:port/db-name -tournament RoboCup2019 -division DivA
FAQs
Unknown package
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.