Research
Security News
Malicious npm Package Targets Solana Developers and Hijacks Funds
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
com.faendir.jraw:lib
Advanced tools
repositories {
jcenter()
}
dependencies {
implementation "net.dean.jraw:JRAW:$jrawVersion"
}
The full documentation is available on GitBooks, but here's a sneak peek:
// Assuming we have a 'script' reddit app
Credentials oauthCreds = Credentials.script(username, password, clientId, clientSecret);
// Create a unique User-Agent for our bot
UserAgent userAgent = new UserAgent("bot", "my.cool.bot", "1.0.0", "myRedditUsername");
// Authenticate our client
RedditClient reddit = OAuthHelper.automatic(new OkHttpNetworkAdapter(userAgent), oauthCreds);
// Get info about the user
Account me = reddit.me().about();
JRAW uses JitPack to host its Javadoc.
https://jitpack.io/com/github/mattbdean/JRAW/VERSION/javadoc/index.html
VERSION
can be a specific commit hash (like d6843bf
), a tag (like v1.0.0
), or the HEAD of a branch (like master-SNAPSHOT
).
JitPack produces Javadoc only when necessary, so the first time someone accesses the Javadoc for a specific build it may take a little bit.
JRAW doesn't target Android specifically, but there is an extension library that solves some quality of life issues. Also be sure to check out the example app that shows how to get users logged in.
To get started you'll need to create two reddit OAuth2 apps, one script and one installed, and then create a subreddit.
To have this done automatically for you, run this command:
$ ./gradlew :meta:credentials --no-daemon --console plain
Your testing account should have at least 100 karma, otherwise you'll run into issues when trying to create a subreddit.
lib/src/test/resources/credentials.json
:
{
"script": {
"username": "...",
"password": "...",
"clientId": "...",
"clientSecret": "..."
},
"app": {
"clientId": "...",
"redirectUrl": "..."
},
"moderationSubreddit": "..."
}
Then you can go ahead and run the tests
$ ./gradlew test
Tests are written with Spek and assertions are done with Expekt.
In order to get the integration tests of the docs
module to pass, you'll need gitbook-cli installed globally. You shouldn't have to worry about this, as most of the contributions are likely to be towards the core library and not its accessory modules.
Kotlin code follows the official conventions provided by JetBrains (with a few exceptions).
A few hard and fast rules:
Define these variables in gradle.properties
:
# Go to gitbook.com -> Account Settings -> Applications/Tokens to get an API key
gitbookUsername=<gitbook username>
gitbookPassword=<gitbook API key or password>
# Go to bintray.com -> Edit Profile -> API Key to get your account's API key
bintrayUser=<bintray username>
bintrayKey=<bintray API key>
# If this property doesn't match the target release, all release-related tasks
# will be disabled
authorizeRelease=<version to release>
Update the version in the root build.gradle and then run the :lib:release
task to perform a release.
$ ./gradlew release --no-daemon --console plain
This task will:
:lib
's tests:meta:update
(see here for what this does)After running the task:
lib/build/libs
.FAQs
Unknown package
We found that com.faendir.jraw:lib demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
Security News
Research
Socket researchers have discovered malicious npm packages targeting crypto developers, stealing credentials and wallet data using spyware delivered through typosquats of popular cryptographic libraries.
Security News
Socket's package search now displays weekly downloads for npm packages, helping developers quickly assess popularity and make more informed decisions.