
Research
Malicious fezbox npm Package Steals Browser Passwords from Cookies via Innovative QR Code Steganographic Technique
A malicious package uses a QR code as steganography in an innovative technique.
@alexlafroscia/dotty
Advanced tools
A tool for declaratively managing your command line tools and configuration
I had a few computers that I do development work on, and it was a annoying to keep them in sync. I wanted a way to script installing and configuring my tools, but lacked tooling in pure shell scripting with the level of polish I desired. I knew I could build the tool I wanted using Node.js, so... here's dotty
!
On a system that already has Node installed, you can grab dotty
as an NPM package from @alexlafroscia/dotty
. If you're setting it up on a new machine, a pkg
-built binary can be found on the Releases tab.
A dotty
task looks something like this:
// tasks/brew.js
module.exports = function(Task) {
return class Homebrew extends Task {
constructor() {
super();
// Set the name of the program being installed
this.programName = 'brew';
}
/**
* Check if the program needs to be installed
*/
checkInstallation() {
return this.which('brew');
}
/**
* Install the program
*/
install() {
return this.exec(
'/usr/bin/ruby -e "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/master/install)"'
);
}
};
};
Check out the example-tasks
directory for more examples that show off the full set of hooks available. The Task
source code has additional information on the available hooks and how they interact with each other.
You can invoke dotty
like so:
dotty path/to/tasks/directory
I recommend keeping your tasks in a location where they can easily be synchronized between all of your machines, such as a dotfiles
repo, iCloud or Dropbox. For example, on my machine, synchronizing a new machine looks like:
dotty $DOTFILES/tasks
since $DOTFILES
is aliased to my dotfiles directory.
FAQs
Programmatically configure your development environment
The npm package @alexlafroscia/dotty receives a total of 2 weekly downloads. As such, @alexlafroscia/dotty popularity was classified as not popular.
We found that @alexlafroscia/dotty demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
A malicious package uses a QR code as steganography in an innovative technique.
Research
/Security News
Socket identified 80 fake candidates targeting engineering roles, including suspected North Korean operators, exposing the new reality of hiring as a security function.
Application Security
/Research
/Security News
Socket detected multiple compromised CrowdStrike npm packages, continuing the "Shai-Hulud" supply chain attack that has now impacted nearly 500 packages.