Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
github.com/sonda2208/google-api-go-client
$ go get google.golang.org/api/tasks/v1
$ go get google.golang.org/api/moderator/v1
$ go get google.golang.org/api/urlshortener/v1
... etc ...
and using:
package main
import (
"net/http"
"google.golang.org/api/urlshortener/v1"
)
func main() {
svc, err := urlshortener.New(http.DefaultClient)
// ...
}
These are auto-generated Go libraries from the Google Discovery Service's JSON description files of the available "new style" Google APIs.
Due to the auto-generated nature of this collection of libraries, complete APIs or specific versions can appear or go away without notice. As a result, you should always locally vendor any API(s) that your code relies upon.
These client libraries are officially supported by Google. However, the libraries are considered complete and are in maintenance mode. This means that we will address critical bugs and security issues but will not add any new features.
If you're working with Google Cloud Platform APIs such as Datastore or Pub/Sub, consider using the Cloud Client Libraries for Go instead. These are the new and idiomatic Go libraries targeted specifically at Google Cloud Platform Services.
The generator itself and the code it produces are beta. Some APIs are alpha/beta, and indicated as such in the import path (e.g., "google.golang.org/api/someapi/v1alpha").
Application Default Credentials provide a simplified way to obtain credentials for authenticating with Google APIs.
The Application Default Credentials authenticate as the application itself, which make them great for working with Google Cloud APIs like Storage or Datastore. They are the recommended form of authentication when building applications that run on Google Compute Engine or Google App Engine.
Default credentials are provided by the golang.org/x/oauth2/google
package. To use them, add the following import:
import "golang.org/x/oauth2/google"
Some credentials types require you to specify scopes, and service entry points may not inject them. If you encounter this situation you may need to specify scopes as follows:
import (
"context"
"golang.org/x/oauth2/google"
"google.golang.org/api/compute/v1"
)
func main() {
// Use oauth2.NoContext if there isn't a good context to pass in.
ctx := context.Background()
client, err := google.DefaultClient(ctx, compute.ComputeScope)
if err != nil {
//...
}
computeService, err := compute.New(client)
if err != nil {
//...
}
}
If you need a oauth2.TokenSource
, use the DefaultTokenSource
function:
ts, err := google.DefaultTokenSource(ctx, scope1, scope2, ...)
if err != nil {
//...
}
client := oauth2.NewClient(ctx, ts)
See also: golang.org/x/oauth2/google package documentation.
FAQs
Unknown package
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.