Research
Security News
Malicious npm Package Targets Solana Developers and Hijacks Funds
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
github.com/sethjback/golang-remote-debug
Proof of concept files for remote debugging golang code inside docker container.
Disclaimer - All of this code/process has been tested on Arch Linux using vs-code and a k8s cluster deployed via kops
running on AWS. If anything is different in your setup ymmv.
The goal is to allow us to run code as if it was in the k8s cluster, attaching our own debugger to it.
There are two things to note right off:
telepresence
handles swapping/routing the k8s traffic to your local code. Debugging of go code proceeds normally (usually dlv
sitting in the middle of your applicaiton code and the IDE)To accomplish this we will configure vs-code to "remote" debug our code, namely inside of a docker container. Once this is configured and working, we can use telepresence
to pass all traffic from the k8s cluster to the container running locally that we are going to debug.
Build Either the Dockerfile.nonbuilt
or Dockerfile.built
conainer:
docker build -t wizfind -f Dockerfile.nonbuilt .
Run the container with the correct params:
docker run -p 40000:40000 -p 8080:8080 --security-opt=seccomp:unconfined --name wizfind wizfind
The --security-opt=seccomp:unconfined
is necessary to allow dlv to acces the golang proc
Use the Launch Remote
debug configuration to have vs code attach to the remote (inside container) dlv process.
Normally vs code will launch it's own dlv
process and connect to it. This configuration will tell it to connect to the process running on docker
There is a test deployment/service config in the k8s
directory under wizFind. Make sure you adjust the namespace, etc. to match your cluster.
Apply using:
kubectl apply -f deploy.yaml
This will create both a deployment and loadbalancer service to expose it to the internet. To find the external endpoint you can:
kubectl get services
On AWS the external service will look something like a925d1da98b8a11e9b51a06dc9dfcc62-1023382574.us-west-2.elb.amazonaws.com
You can test this by visiting the external IP on port 8080
(the default)
To do local debugging, use telepresence to swap out the in-cluster service with the local docker container.
telepresence --swap-deployment wizfind --expose 8080 --docker-run --rm -p 40000:40000 -p 8080:8080 --security-opt=seccomp:unconfined --name wizfind wizfind
In vs-code, launch the debugger and you will see the wizFind service start. Going to the external IP noted above, the traffic will now be routed to your locally running container. You can test this by setting breakpoints in vs code and confirming they are triggered when you hit the external URL.
Once you stop debugging in vs code the container will exit and telepresence will restore the original config.
FAQs
Unknown package
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
Security News
Research
Socket researchers have discovered malicious npm packages targeting crypto developers, stealing credentials and wallet data using spyware delivered through typosquats of popular cryptographic libraries.
Security News
Socket's package search now displays weekly downloads for npm packages, helping developers quickly assess popularity and make more informed decisions.