Research
Security News
Malicious npm Package Targets Solana Developers and Hijacks Funds
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
github.com/schneizelw/elasticsearch/procfs
This procfs package provides functions to retrieve system, kernel and process metrics from the pseudo-filesystems /proc and /sys.
WARNING: This package is a work in progress. Its API may still break in backwards-incompatible ways without warnings. Use it at your own risk.
The procfs library is organized by packages based on whether the gathered data is coming from
/proc, /sys, or both. Each package contains an FS
type which represents the path to either /proc, /sys, or both. For example, current cpu statistics are gathered from
/proc/stat
and are available via the root procfs package. First, the proc filesystem mount
point is initialized, and then the stat information is read.
fs, err := procfs.NewFS("/proc")
stats, err := fs.Stat()
Some sub-packages such as blockdevice
, require access to both the proc and sys filesystems.
fs, err := blockdevice.NewFS("/proc", "/sys")
stats, err := fs.ProcDiskstats()
The procfs library is normally built as part of another application. However, when making
changes to the library, the make test
command can be used to run the API test suite.
The procfs library includes a set of test fixtures which include many example files from
the /proc
and /sys
filesystems. These fixtures are included as a ttar file
which is extracted automatically during testing. To add/update the test fixtures, first
ensure the fixtures
directory is up to date by removing the existing directory and then
extracting the ttar file using make fixtures/.unpacked
or just make test
.
rm -rf fixtures
make test
Next, make the required changes to the extracted files in the fixtures
directory. When
the changes are complete, run make update_fixtures
to create a new fixtures.ttar
file
based on the updated fixtures
directory. And finally, verify the changes using
git diff fixtures.ttar
.
FAQs
Unknown package
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
Security News
Research
Socket researchers have discovered malicious npm packages targeting crypto developers, stealing credentials and wallet data using spyware delivered through typosquats of popular cryptographic libraries.
Security News
Socket's package search now displays weekly downloads for npm packages, helping developers quickly assess popularity and make more informed decisions.