
Research
Malicious npm Package Brand-Squats TanStack to Exfiltrate Environment Variables
A brand-squatted TanStack npm package used postinstall scripts to steal .env files and exfiltrate developer secrets to an attacker-controlled endpoint.
github.com/wificoin-project/wfcd
Advanced tools
wfcd is an alternative full node wificoin implementation written in Go (golang).
Go 1.8 or newer.
https://github.com/wificoin-project/wfc/releases
Install Go according to the installation instructions here: http://golang.org/doc/install
Mirror set
glide mirror set https://golang.org/x/crypto https://github.com/golang/crypto --vcs git
$ go version
$ go env GOROOT GOPATH
NOTE: The GOROOT and GOPATH above must not be the same path. It is
recommended that GOPATH is set to a directory in your home directory such as
~/goprojects to avoid write permission issues. It is also recommended to add
$GOPATH/bin to your PATH at this point.
$ go get -u github.com/Masterminds/glide
$ git clone https://github.com/wificoin-project/wfcd $GOPATH/src/github.com/wificoin-project/wfcd
$ cd $GOPATH/src/github.com/wificoin-project/wfcd
$ glide install
$ go install . ./cmd/...
$GOPATH/bin. If you did
not already add the bin directory to your system path during Go installation,
we recommend you do so now.Install a newer MSI
$ cd $GOPATH/src/github.com/wificoin-project/wfcd
$ git pull && glide install
$ go install . ./cmd/...
wfcd has several configuration options available to tweak how it runs, but all of the basic operations described in the intro section work with zero configuration.
$ ./wfcd
The documentation is a work-in-progress.
wfcd is licensed under the copyfree ISC License.
FAQs
Unknown package
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A brand-squatted TanStack npm package used postinstall scripts to steal .env files and exfiltrate developer secrets to an attacker-controlled endpoint.

Research
Compromised SAP CAP npm packages download and execute unverified binaries, creating urgent supply chain risk for affected developers and CI/CD environments.

Company News
Socket has acquired Secure Annex to expand extension security across browsers, IDEs, and AI tools.