
Research
PyPI Package Disguised as Instagram Growth Tool Harvests User Credentials
A deceptive PyPI package posing as an Instagram growth tool collects user credentials and sends them to third-party bot services.
github.com/sourcegraph/go-langserver
go-langserver is a Go language server that speaks Language Server Protocol. It supports editor features such as go-to-definition, hover, and find-references for Go projects.
To build and install the standalone go-langserver
run
go get -u github.com/sourcegraph/go-langserver
Hover | Jump to def | Find references | Workspace symbols | VFS extension | Isolated | Parallel | |
---|---|---|---|---|---|---|---|
Go | ✔ | ✔ | ✔ | ✔ | ✔ | ✔ | ✔ |
If you are a client wanting to integrate go-langserver, you can use the following as initializationOptions
in your initialize request to adjust the behaviour:
interface GoInitializationOptions {
/**
* funcSnippetEnabled enables the returning of argument snippets
* on `func` completions, eg. func(foo string, arg2 bar).
* Requires code completion to be enabled.
*
* Defaults to true if not specified.
*/
funcSnippetEnabled?: boolean;
/**
* gocodeCompletionEnabled enables code completion feature (using gocode).
*
* Defaults to false if not specified.
*/
gocodeCompletionEnabled?: boolean;
/**
* formatTool decides which tool is used to format documents. Supported: goimports and gofmt.
*
* Defaults to goimports if not specified.
*/
formatTool?: "goimports" | "gofmt";
/**
* goimportsLocalPrefix sets the local prefix (comma-separated string) that goimports will use.
*
* Defaults to empty string if not specified.
*/
goimportsLocalPrefix?: string;
/**
* MaxParallelism controls the maximum number of goroutines that should be used
* to fulfill requests. This is useful in editor environments where users do
* not want results ASAP, but rather just semi quickly without eating all of
* their CPU.
*
* Defaults to half of your CPU cores if not specified.
*/
maxParallelism?: number;
/**
* useBinaryPkgCache controls whether or not $GOPATH/pkg binary .a files should
* be used.
*
* Defaults to true if not specified.
*/
useBinaryPkgCache?: boolean;
}
If you run into performance issues while using the language server, it can be very helpful to attach a CPU or memory profile with the issue report. To capture one, first install Go and then:
Capture a heap (memory) profile:
go tool pprof -svg $GOPATH/bin/go-langserver http://localhost:6060/debug/pprof/heap > heap.svg
Capture a CPU profile:
go tool pprof -svg $GOPATH/bin/go-langserver http://localhost:6060/debug/pprof/profile > cpu.svg
Since these capture the active resource usage, it's best to run these commands while the issue is occurring (i.e. while memory or CPU is high).
FAQs
Unknown package
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
A deceptive PyPI package posing as an Instagram growth tool collects user credentials and sends them to third-party bot services.
Product
Socket now supports pylock.toml, enabling secure, reproducible Python builds with advanced scanning and full alignment with PEP 751's new standard.
Security News
Research
Socket uncovered two npm packages that register hidden HTTP endpoints to delete all files on command.