Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
github.com/the-heap/beacon
Read this to get to know what we're building for this project!
Beacon wants to be a helpful tool that makes it easier to keep up to date with breaking changes in your applications when working on a team. Here's an ideal use case of Beacon:
Note, I intend for this project to be written in Golang; there are a lot of boilerplate tools and libraries for building CLI tools more easily; but we'll try building this from scratch so we can get to know the language. I, at least, want to improve my understanding of Go at a more basic level. Also, as someone who started out as a web dev, I have less experience with simple stuff like reading / writing files / command line tooling.
What problem does this tool address?
Good question. If something breaks in a team application, it can take a while to find out what; you may have to crawl through some git logs or start yelling until someone tells you to calm down and what you need to do. Now you can avoid that by having a specific changelog that only deals with logging important breaking changes.
Read this to learn how The Heap works collaboratively on projects.
Welcome to one of THE HEAP's open source projects! Let's take a moment to identify the environment that we will be collaborating in. This project aims to be as accessible as possible to people who want to contribute to open source code! We've got a few things to go over, so if you're new to Github, or contributing to open source software, take a breather and then read on! You got this. 👌
Before we get into the project itself, let's get to know our collaborative environment:
The following steps will inform the code you write and help you make good pull requests.
Read this to learn how to get the project running on your local computer
~/go/src/github.com/{yourGithubUserName}/beacon
go build
to compile a binary of Beaconbeacon all
-> should print the entire beacon log)Read this to get to know terminology that might help to clarify some aspects of the project / dispel jargon
CLI - (Command line tool). A tool used from your computer's terminal (aka; command line)
Breaking Change - This is a broad term. For the purpose of this project, a breaking change is any changes to your tech / dev environment that will halt other people's ability to develop and hack until they update / upgrade / resolve the change as the original author of the change did.
Thanks goes to these wonderful people (emoji key):
Bronek Szulc 💻 👀 | Matthew Mihok 💬 👀 | Tyler 💻 🎨 📖 📋 | Jared Bydeley 💻 👀 | Ben Marshall 💻 👀 |
---|
This project follows the all-contributors specification. Contributions of any kind welcome!
FAQs
Unknown package
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.