Research
Security News
Malicious npm Package Targets Solana Developers and Hijacks Funds
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
github.com/savannahghi/server_utils
serverutils are utilities used by several backend services. These includes starting up and running the server.
serverutils is compatible with modern Go releases in module mode, with Go installed:
go get -u github.com/savannahghi/serverutils
will resolve and add the package to the current development module, along with its dependencies.
Alternatively the same can be achieved if you use import in a package:
import "github.com/savannahghi/serverutils"
and run go get
without parameters.
The package name is serverutils
The default branch library is main
We try to follow semantic versioning ( https://semver.org/ ). For that reason, every major, minor and point release should be tagged.
git tag -m "v0.0.1" "v0.0.1"
git push --tags
Continuous integration tests must pass on Travis CI. Our coverage threshold is 90% i.e you must keep coverage above 90%.
In order to run tests, you need to have an env.sh
file similar to this one:
# Application settings
export DEBUG=true
export IS_RUNNING_TESTS=true
export SENTRY_DSN=<a Sentry Data Source Name>
export GOOGLE_CLOUD_PROJECT="Google Cloud project id"
This file must not be committed to version control.
It is important to export the environment variables. If they are not exported,
they will not be visible to child processes e.g go test ./...
.
These environment variables should also be set up on Travis CI environment variable section.
I would like to cover the entire GitHub API and contributions are of course always welcome. The
calling pattern is pretty well established, so adding new methods is relatively
straightforward. See CONTRIBUTING.md
for details.
In general, serverutils follows semver as closely as we can for tagging releases of the package. For self-contained libraries, the application of semantic versioning is relatively straightforward and generally understood. We've adopted the following versioning policy:
This library is distributed under the MIT license found in the LICENSE file.
FAQs
Unknown package
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
Security News
Research
Socket researchers have discovered malicious npm packages targeting crypto developers, stealing credentials and wallet data using spyware delivered through typosquats of popular cryptographic libraries.
Security News
Socket's package search now displays weekly downloads for npm packages, helping developers quickly assess popularity and make more informed decisions.