Research
Security News
Malicious npm Package Targets Solana Developers and Hijacks Funds
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
go.arsenm.dev/pcre
This package provides a CGo-free port of the PCRE2 regular expression library. The lib directory contains source code automatically translated from PCRE2's C source. This package wraps that code and provides an interface as close as possible to Go's stdlib regexp package
Due to the use of PCRE2, this library contains extra features such as lookaheads/lookbehinds. The stdlib regex engine, RE2, left these features out for a reason. It's easy to create regular expressions with this library that have exponential runtime. This creates the possibility of a denial of service attack. Only use this library if the extra features are needed and the user providing the regex is trusted (such as if it's in a config file). Otherwise, use the standard library regexp package.
More OS support is planned.
In order to transpile pcre2, a Go and C compiler (preferably GCC) will be needed.
First, install ccgo
Then, download the pcre source code. It can be found here: https://github.com/PCRE2Project/pcre2.
Once downloaded, cd
into the source directory
Run ./configure
. If cross-compiling, provide the path to the cross-compiler in the CC
variable, and set --target
to the target architecture.
When it completes, there should be a Makefile
in the directory.
Run ccgo -compiledb pcre.json make
. Do not add -j
arguments to the make command.
Run the following command (replace items in triangle brackets):
CC=/usr/bin/gcc ccgo -o pcre2_<os>_<arch>.go -pkgname lib -trace-translation-units -export-externs X -export-defines D -export-fields F -export-structs S -export-typedefs T pcre.json .libs/libpcre2-8.a
If cross-compiling, set the CCGO_CC
variable to to path of the cross-compiler, and the CCGO_AR
variable to the path of the cross-compiler's ar
binary. Also, set TARGET_GOARCH
to the GOARCH you're targeting and TARGET_GOOS
to the OS you're targeting.
Once the command completes, two go files will be created. One will start with pcre2
, the other with capi
. Copy both of these to the lib
directory in this repo.
FAQs
Unknown package
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
Security News
Research
Socket researchers have discovered malicious npm packages targeting crypto developers, stealing credentials and wallet data using spyware delivered through typosquats of popular cryptographic libraries.
Security News
Socket's package search now displays weekly downloads for npm packages, helping developers quickly assess popularity and make more informed decisions.