
Research
Namastex.ai npm Packages Hit with TeamPCP-Style CanisterWorm Malware
Malicious Namastex.ai npm packages appear to replicate TeamPCP-style Canister Worm tradecraft, including exfiltration and self-propagation.
@inthepocket/hubble-mirror
Advanced tools

Hubble mirror is the core of the hubble system, it is used to apply the HST system to a specific project.
Use the provided install script and run this from your project root to create the required files for hubble-mirror:
# Install for a generic project:
$ curl -o- https://storage.googleapis.com/hubble-static/install_hubble-mirror.sh?latest=true | bash
# Install for an iOS project
$ curl -o- https://storage.googleapis.com/hubble-static/install_hubble-mirror.sh?latest=true | bash -s -- --platform ios
# Show help for the installer script
$ curl -o- https://storage.googleapis.com/hubble-static/install_hubble-mirror.sh?latest=true | bash -s -- --help
# Alternatively, download install_hubble-mirror.sh from this repo, modify and run it:
$ chmod +x install_hubble-mirror.sh
$ ./install_hubble-mirror.sh --help
npm i @inthepocket/hubble-mirror
{
"source": {
"assets": ".hubble/src/design-systems-demo/assets",
"hst": ".hubble/src/design-systems-demo/hubble.json"
},
"postProcess": "hubble-postprocess.sh",
"target": {
"assets": "/assets",
"hst": "./hst.json"
},
"deployPreview": {
"publishDirectory": "/build",
"previewUrl": "hubble-mirror-domain-preview-url"
}
}
Process the current .hubble config and assets into the project.
hubble-mirror:process
Run your custom made postprocess script. To handle the changes specific to your project. For example:
Create a file somewhere inside your root directory: postprocess.sh, specify its location in the .hubble-mirror.json file and run hubble-mirror:postProcess.
Make sure this file is executable, if postprocess.sh is not executable by a shell, the process will fail!
Deploy the processed changes on a preview url with surge.
Run hubble-mirror:deployPreview.
Optionally add:
Conventions:
To autogenerate a Pull Request on your repo, we've added a utility script: hubble-mirror:createPR
Optionally add:
Bump version correctly, then run the release run-script. It will test the code before publishing and tag it with the correct git tag.
# To go from 0.0.4 to 0.1.0
$ npm version minor
$ npm run release
If you are making changes to the install script, make sure to deploy it. This sends the script + its assets to a public Google Cloud bucket.
You will need gsutil installed, must be logged in with it and have access to the hubble-static bucket
$ npm run deploy:install-script
FAQs
The heart of the Hubble Design System
We found that @inthepocket/hubble-mirror demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 10 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Malicious Namastex.ai npm packages appear to replicate TeamPCP-style Canister Worm tradecraft, including exfiltration and self-propagation.

Product
Explore exportable charts for vulnerabilities, dependencies, and usage with Reports, Socket’s new extensible reporting framework.

Product
Socket for Jira lets teams turn alerts into Jira tickets with manual creation, automated ticketing rules, and two-way sync.