Research
Security News
Kill Switch Hidden in npm Packages Typosquatting Chalk and Chokidar
Socket researchers found several malicious npm packages typosquatting Chalk and Chokidar, targeting Node.js developers with kill switches and data theft.
@amagaki/amagaki-plugin-preview
Advanced tools
[![NPM Version][npm-image]][npm-url] [![GitHub Actions][github-image]][github-url] [![TypeScript Style Guide][gts-image]][gts-url]
An experimental plugin for Amagaki that facilitates content previews.
Features include:
import { PreviewPlugin } from '@amagaki/amagaki-plugin-preview';
export default function (pod: Pod) {
PreviewPlugin.register(pod);
}
Compute Engine default service account
.openssl base64 -in <file>.json | pbcopy
GCP_SA_KEY
.GH_TOKEN
that has a GitHub token (i.e. a
Personal Access Token) of an account that has read access to your repo. NOTE:
This requirement will be abandoned in a future version as we can authenticate
via GitHub Actions' built-in token instead..github/workflows/deploy-preview-server.yml
into your repository.GCP_PROJECT_ID
SITE
A central proxy server is deployed one time only, which provides:
Unauthenticated traffic is permitted to the instance, and the instance authorizes requests within the application.
Requests to the proxy invoke a lookup of the Cloud Run instance, mapping its
hostname to labels written when it was deployed. For example, using
https://site--main.instance.com
:
preview-server=true
preview-site=site
preview-branch-token=main
If no instance at all is found, show an error message that explains the Cloud
Run instance hasn't been deployed yet. If a base instance is found (i.e. against
the main
or master
branch), yet no branch instance is found, the request
will be served by the main instance. This facilitates instant previews of
branches without requiring a the Cloud Run instance to be deployed first.
Once the lookup occurs and once an instance has been found, the result is cached to a file on the proxy's filesystem. Because the filesystem is ephemeral, the lookup result is only cached as long as the file remains. If a backend is not found given a hostname, the result is not cached.
The proxy server is deployed once per tenant or orgnaization. It is deployed on Google App Engine in order to support wildcard subdomains.
FAQs
[![NPM Version][npm-image]][npm-url] [![TypeScript Style Guide][gts-image]][gts-url]
We found that @amagaki/amagaki-plugin-preview demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket researchers found several malicious npm packages typosquatting Chalk and Chokidar, targeting Node.js developers with kill switches and data theft.
Security News
pnpm 10 blocks lifecycle scripts by default to improve security, addressing supply chain attack risks but sparking debate over compatibility and workflow changes.
Product
Socket now supports uv.lock files to ensure consistent, secure dependency resolution for Python projects and enhance supply chain security.