Research
Security News
Malicious npm Package Targets Solana Developers and Hijacks Funds
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
yuki.nu/g/yukispace
分布式 WebDAV 文件系统,主要功能包括:
本程序需要 go ver 1.21+
在项目根目录运行以下命令编译:
go generate ./...
go test ./... || exit 1
go build -ldflags "-s -w" .
本程序将会在指定端口运行 WebDAV 服务,其中:
/dav
: HTTP DAV 协议路径/web
: 支持浏览器的文件目录创建以下配置文件:
# test.toml
[Global]
FileSystemID = 'test'
ListenAddress = ':8081'
PublishAddress = 'http://127.0.0.1:8081/dav/'
CompactIntervalSecs = 21600
CompactCheckCorrupted = false
[Partitions]
[Partitions.default]
DataFolder = '/tmp/dummy'
MetadataStoreURL = 'inmemory://'
运行以下命令:
yukispace --use-mem-fs --config test.toml
以上将在 127.0.0.1:8081
端口上运行 WebDAV 服务, 该服务产生的文件只会保存到内存中, WebDAV中的文件将会在程序退出后丢失。
# 创建 `testfolder` 文件夹
curl -X MKCOL 127.0.0.1:8081/dav/testfolder
# 将 `test.txt` 上传到 `testfolder` 文件夹
echo test data $(date +%s) > /tmp/test.txt
curl -T /tmp/test.txt 127.0.0.1:8081/dav/testfolder/test.txt
在浏览器中打开 http://127.0.0.1:8081/web
查看上传的文件。
假设有 2 台服务器, server-A 和 server-B.
对于第一台服务器,创建以下配置文件:
# /etc/yukispace/config.toml
[Global]
FileSystemID = '<permanent unique string ID for server-A>'
ListenAddress = ':8081'
PublishAddress = 'http://<server-A public address>/dav/'
CompactIntervalSecs = 21600
CompactCheckCorrupted = false
DataFolder = '/mnt/archive/yukispace/data'
EnableKVService = true
[Partitions]
[Partitions.default]
MetadataStoreURL = 'http://<server-A public address>/kv/'
IsServingRegion = true
第二台服务器:
# /etc/yukispace/config.toml
[Global]
FileSystemID = '<permanent unique string ID for server-B>'
ListenAddress = ':8081'
PublishAddress = 'http://<server-B public address>/dav/'
CompactIntervalSecs = 21600
CompactCheckCorrupted = false
DataFolder = '/mnt/archive/yukispace/data'
EnableKVService = true
[Partitions]
[Partitions.default]
MetadataStoreURL = 'http://<server-A public address/kv/'
IsServingRegion = true
并在两台服务器上分别运行
yukispace --config /etc/yukispace/config.toml
两台服务器将运行同一 WebDAV 服务:
default
分区, 这意味着上传的文件将会保存在对应的服务器上, 两台服务器都可以服务所有文件,但服务器之间不会进行文件转移MIT License
FAQs
Unknown package
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
Security News
Research
Socket researchers have discovered malicious npm packages targeting crypto developers, stealing credentials and wallet data using spyware delivered through typosquats of popular cryptographic libraries.
Security News
Socket's package search now displays weekly downloads for npm packages, helping developers quickly assess popularity and make more informed decisions.