
Research
Malicious npm Package Brand-Squats TanStack to Exfiltrate Environment Variables
A brand-squatted TanStack npm package used postinstall scripts to steal .env files and exfiltrate developer secrets to an attacker-controlled endpoint.
github.com/vincechen611/xk6-redis
Advanced tools
This is a Redis client library for k6, implemented as an extension using the xk6 system.
| :exclamation: This is a proof of concept, isn't supported by the k6 team, and may break in the future. USE AT YOUR OWN RISK! |
|---|
Note that there is already a k6 Redis extension that uses a different Go library and slightly different API. The extension in this current repo served as an example for an xk6 tutorial article, but using one or the other is up to the user. :)
To build a k6 binary with this extension, first ensure you have the prerequisites:
Then:
xk6:go get -u github.com/k6io/xk6/cmd/xk6
xk6 build v0.29.0 --with github.com/k6io/xk6-redis
// test.js
import redis from 'k6/x/redis';
const client = new redis.Client({
addr: 'localhost:6379',
password: '',
db: 0,
});
export default function () {
client.set('mykey', 'myvalue', 0);
console.log(`mykey => ${client.get('mykey')}`);
}
Result output:
$ ./k6 run test.js
/\ |‾‾| /‾‾/ /‾‾/
/\ / \ | |/ / / /
/ \/ \ | ( / ‾‾\
/ \ | |\ \ | (‾) |
/ __________ \ |__| \__\ \_____/ .io
execution: local
script: test.js
output: -
scenarios: (100.00%) 1 scenario, 1 max VUs, 10m30s max duration (incl. graceful stop):
* default: 1 iterations for each of 1 VUs (maxDuration: 10m0s, gracefulStop: 30s)
INFO[0000] mykey => myvalue source=console
running (00m00.0s), 0/1 VUs, 1 complete and 0 interrupted iterations
default âś“ [======================================] 1 VUs 00m00.0s/10m0s 1/1 iters, 1 per VU
data_received........: 0 B 0 B/s
data_sent............: 0 B 0 B/s
iteration_duration...: avg=834.68µs min=834.68µs med=834.68µs max=834.68µs p(90)=834.68µs p(95)=834.68µs
iterations...........: 1 54.622575/s
FAQs
Unknown package
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A brand-squatted TanStack npm package used postinstall scripts to steal .env files and exfiltrate developer secrets to an attacker-controlled endpoint.

Research
Compromised SAP CAP npm packages download and execute unverified binaries, creating urgent supply chain risk for affected developers and CI/CD environments.

Company News
Socket has acquired Secure Annex to expand extension security across browsers, IDEs, and AI tools.