Research
Security News
Malicious npm Package Targets Solana Developers and Hijacks Funds
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
github.com/rubygems/bundler
Bundler makes sure Ruby applications run the same code on every machine.
It does this by managing the gems that the application depends on. Given a list of gems, it can automatically download and install those gems, as well as any other gems needed by the gems that are listed. Before installing gems, it checks the versions of every gem to make sure that they are compatible, and can all be loaded at the same time. After the gems have been installed, Bundler can help you update some or all of them when new versions become available. Finally, it records the exact versions that have been installed, so that others can install the exact same gems.
To install (or update to the latest version):
gem install bundler
To install a prerelease version (if one is available), run gem install bundler --pre
. To uninstall Bundler, run gem uninstall bundler
.
Bundler is most commonly used to manage your application's dependencies. For example, these commands will allow you to use Bundler to manage the rspec
gem for your application:
bundle init
bundle add rspec
bundle install
bundle exec rspec
See bundler.io for the full documentation.
For help with common problems, see TROUBLESHOOTING.
Still stuck? Try filing an issue.
To see what has changed in recent versions of Bundler, see the CHANGELOG.
To get in touch with the Bundler core team and other Bundler users, please see getting help.
If you'd like to contribute to Bundler, that's awesome, and we <3 you. We've put together the Bundler contributor guide with all of the information you need to get started.
If you'd like to request a substantial change to Bundler or to the Bundler documentation, refer to the Bundler RFC process for more information.
While some Bundler contributors are compensated by Ruby Together, the project maintainers make decisions independent of Ruby Together. As a project, we welcome contributions regardless of the author's affiliation with Ruby Together.
Ruby Together pays some Bundler maintainers for their ongoing work. As a grassroots initiative committed to supporting the critical Ruby infrastructure you rely on, Ruby Together is funded entirely by the Ruby community. Contribute today as an individual or (better yet) as a company to ensure that Bundler, RubyGems, and other shared tooling is around for years to come.
Everyone interacting in the Bundler project's codebases, issue trackers, chat rooms, and mailing lists is expected to follow the Bundler code of conduct.
Bundler is available under an MIT License.
FAQs
Unknown package
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
Security News
Research
Socket researchers have discovered malicious npm packages targeting crypto developers, stealing credentials and wallet data using spyware delivered through typosquats of popular cryptographic libraries.
Security News
Socket's package search now displays weekly downloads for npm packages, helping developers quickly assess popularity and make more informed decisions.