
Research
Malicious npm Packages Impersonate Flashbots SDKs, Targeting Ethereum Wallet Credentials
Four npm packages disguised as cryptographic tools steal developer credentials and send them to attacker-controlled Telegram infrastructure.
@firebase-me/tracker
Advanced tools
*Alpha v0.1 This is a Firebase Usage Tracker, it is designed to to capture snapshots from firebase calls to Firestore and Realtime, Storage is not functional at this current time.
The package uses the REST API to reduce any potential overhead
to Use:
import tracker from '@firebase-me/tracker';
tracker.init(databaseUrl, auth?(optional), ping?(optional))
when the user state changes, the user auth object needs to be updated:
onAuthStateChanged(user){
tracker.updateAuth(user)
}
If you are not using the web modules; the only required fields are the user UID and the ID token for authenticating the request.
you can pass it as the user
object as such {uid:"userUID", idToken:"ID token Credential"}
There are 3 ways we intend to allow users to utilize this suite:
1: Pass the snapshot from the request into the appropriate tracker method and it will update to the appropriate realtime DB.
2: Assign a custom callback function via: tracker.<service>.setCallback(myFuntion)
which expects a single parameter payload(3)
3: If no callback(2) is assigned and the tracker has not been initialized: it will simply return the payload as a JSON object so you can handle it through a console log, custom integration, etc.
To use the trigger to log each respective database type:
// Firestore
tracker.firestore.trigger(snapshot|data, meta?, customPath?)
// Realtime DB
tracker.realtime.trigger(snapshot|data, meta?, customPath?)
// Storage (not implimented)
// tracker.storage.trigger(snapshot|data, meta?, customPath?)
// Custom Meta
tracker.meta.trigger(payloadObject|data, meta?, customPath?)
Each snapshot is evaluated, Firestore as Documents (supports cached tracking) Realtime DB is evaluated as Bytes and rounded to the nearest KB Meta uses the same as Realtime. Each trigger also supports custom path overrides, allowing you to define assign the snapshot path as a unique path independant of their original reference path. This can be used for custom filtering and targeting.
Standard payload:
{
time: timestamp,
auth: string | null,
path: string | null,
size: number | null,
cache: number | null, // firestore only
meta: string | null,
}
Storage is not functional at this time, please do not use it as it will most likely throw errors.
FAQs
A firebase database tracker
The npm package @firebase-me/tracker receives a total of 0 weekly downloads. As such, @firebase-me/tracker popularity was classified as not popular.
We found that @firebase-me/tracker demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Four npm packages disguised as cryptographic tools steal developer credentials and send them to attacker-controlled Telegram infrastructure.
Security News
Ruby maintainers from Bundler and rbenv teams are building rv to bring Python uv's speed and unified tooling approach to Ruby development.
Security News
Following last week’s supply chain attack, Nx published findings on the GitHub Actions exploit and moved npm publishing to Trusted Publishers.