
Research
Malicious npm Packages Impersonate Flashbots SDKs, Targeting Ethereum Wallet Credentials
Four npm packages disguised as cryptographic tools steal developer credentials and send them to attacker-controlled Telegram infrastructure.
@cloudcannon/asset-uploader
Advanced tools
$ npm install -g @cloudcannon/asset-uploader
$ asset-uploader COMMAND
running command...
$ asset-uploader (-v|--version|version)
@cloudcannon/asset-uploader/0.2.1 darwin-x64 node-v10.19.0
$ asset-uploader --help [COMMAND]
USAGE
$ asset-uploader COMMAND
...
This package is designed to read all .html
and .md
files from a source repository (-s
) and parse the front-matter object looking for image keys (keys that contain _path
, image
or thumbnail
) that have a value pointing to a local file.
Each image will be uploaded into the configured folder (-f
) to S3 or Cloudinary based on the uploader selected (-u
).
For every sucessfull image uploaded the process will rewrite the path on the source .html
or .md
files.
Images uploaded to S3 can use a prefix (-p
) appended to URL to be updated on the source files.
No changes are commit to the repo. This package only modifies the local files from the source directory.
In order to use this package you need to provide valid API Keys.
Before you run the commands, please export the keys to environment variables using the following commands:
$ export AWS_KEY='ABCDEFGHIJKLMNOPQRST'
$ export AWS_SECRET='XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX'
$ export BUCKET='my-bucket-name'
You can generate and managed the keys from the Cloudinary security settings page
$ export CLOUD_NAME='my-cloud-name'
$ export API_KEY='123456789012345'
$ export API_SECRET='abcdefghijklmnopqrstuvwxyza'
asset-uploader analyse
Provide an output with the list of assets found to be uploaded. Does not upload any files.
USAGE
$ asset-uploader analyse
OPTIONS
-o, --output=output filename for output changes summary
-s, --source=source source of the website to be parsed
See code: src/commands/analyse.js
asset-uploader complete
Scan source directory, upload assets and rewrite source files with the new asset location.
USAGE
$ asset-uploader complete
OPTIONS
-f, --folder=folder folder where to upload the files
-o, --output=output filename for output changes summary
-p, --prefix=prefix prefix for the URL of the uploaded asset - only applicable to S3 uploader
-s, --source=source source of the website to be parsed
-u, --uploader=uploader uploader to be used. Choose between: "S3"|"cloudinary"
See code: src/commands/complete.js
asset-uploader help [COMMAND]
display help for asset-uploader
USAGE
$ asset-uploader help [COMMAND]
ARGUMENTS
COMMAND command to show help for
OPTIONS
--all see all commands in CLI
See code: @oclif/plugin-help
asset-uploader upload
Scan source directory and upload assets to selected provider. Does not update the original source files.
USAGE
$ asset-uploader upload
OPTIONS
-f, --folder=folder folder where to upload the files
-o, --output=output filename for output changes summary
-p, --prefix=prefix prefix for the URL of the uploaded asset - only applicable to S3 uploader
-s, --source=source source of the website to be parsed
-u, --uploader=uploader uploader to be used. Choose between: "S3"|"cloudinary"
See code: src/commands/upload.js
FAQs
asset-uploader ==============
We found that @cloudcannon/asset-uploader demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 5 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Four npm packages disguised as cryptographic tools steal developer credentials and send them to attacker-controlled Telegram infrastructure.
Security News
Ruby maintainers from Bundler and rbenv teams are building rv to bring Python uv's speed and unified tooling approach to Ruby development.
Security News
Following last week’s supply chain attack, Nx published findings on the GitHub Actions exploit and moved npm publishing to Trusted Publishers.