Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
@kayako/apps-manifest
Advanced tools
Below is a sample manifest file with description of their key/value pairs.
{
"name": "sales-force",
"displayName": "Sales force",
"version": "1.0.0",
"bundleDir": "dist",
"slots": [
{
"url": "dist/index.html",
"location": "messenger-home-screen"
}
],
"access": "public",
"platforms": ["messenger"],
"whiteListedDomains": ["https://{{ prompts.desk }}.salesforce.com"],
"prompts": [
{
"key": "apiKey",
"label": "Api Key",
"description": "Api key required to authenticate with sales force",
"type": "text",
"access": "public",
"required": true
}
],
"secrets": {
"gaKey": "GA90121003"
}
}
The app name must be unique in the entire marketplace. We follow the npm naming rules.
Name to be used for display purpose. This will be shown in the marketplace listing.
A valid semver version.
Directory to be zipped and published with the apps marketplace.
url
and the location
.url
can be relative URL to the file-system. This package doesn't validate the type/format of the url.Below is the list of allowed platforms.
App access. It can be public
or private
.
Private apps can only be installed by the app publisher and public
apsp will be available on the marketplace for everyone.
An array of platforms supported by the app. An app can run on multiple platforms by defining appropriate slots
.
For example, you can have 2 slots one for the agent
and other for the messenger
.
{
"slots": [
{
"location": "case-sidebar",
"url": "dist/agent.html"
},
{
"location": "messenger-home-screen",
"url": "dist/messenger.html"
}
],
"platforms": ["agent", "messenger"]
}
Below is the list of allowed platforms.
An array of whitelisted domains to be available to HTTP requests.
If your app does not define whiteListedDomains
, it will not be able to make an HTTP requests.
Also you can define dynamic placeholders values for runtime values. For example
{
"whiteListedDomains": [
"http://salesforce.com?key={{ prompts.apiKey }}"
]
}
An array of prompts to collect data from when someone install your app. The values for prompts can be accessed as {{prompts.<key>}}
when making HTTP requests.
Each object can/must have following keys.
Key | Required | Default value | Description |
---|---|---|---|
key | Yes | null | Required and must be unique |
label | No | Human readable form of key | Label to displayed next to the form field |
description | No | null | Prompt description |
access | No | private | Prompt access level. It must public or protected . The values for public prompts are passed to the app initializer. |
type | No | text | Prompt type. Must be text , secure , longtext or json . |
required | No | true | Whether or not prompt is required |
A key/value store of app secrets. Each app can save secrets to be used during the HTTP requests without exposing them to the client.
FAQs
Parser and validator for apps manifest.json file
We found that @kayako/apps-manifest demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 6 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.