
Research
Malicious npm Package Brand-Squats TanStack to Exfiltrate Environment Variables
A brand-squatted TanStack npm package used postinstall scripts to steal .env files and exfiltrate developer secrets to an attacker-controlled endpoint.
@kurtosys/udm_data_toolkit
Advanced tools
Interface library for loading data into fund press.
Simply run npm install on the root folder of this project to install
For a dev build run npm run build
For a production build run npm run build:prod
This project has very experimental type definitions that attempts to document the functions for it. It doesn't cover the entire api so you can ignore large sections of it for now.
If you use vscode regardless if you use typescript or javascript you should get documentation built in and autocomplete.

/dist <-- Output Folder
/src <-- Source Directory
/utils
index.js <-- Entry Point
kDataToolkit.d.ts <-- Type Definitions
webpack.config.js <-- Build Configuration
This is just to document the current changes with the ftps. A more thorough one will be done later. First there is the ftp folder you are pulling the files from it needs to be defined as ftpPath. This has been put on the LOADER_CONFIG object as ftpPath.
There are two functions syncFTPFolder and finalizeFTP.
Call syncFtpFolder with the remote path for the ftp it will return a promise that resolves with all the file names that have been copied. It syncs with your local ${globalRoot}/pending folder.
Once your loader is complete call finalizeFTP with the remote path this will archive all of the files into a zip clear the pending folder and clear the ftp folder.
import {
LOADER_CONFIG,
syncFTPFolder,
finalizeFTP,
registerLoaderStart,
registerLoaderEnd,
initDataToolkitConfig,
login,
getClient
} from "@kurtosys/udm_data_toolkit";
const manifest = require("rootDir/config/manifest");
const { ftpPath } = LOADER_CONFIG.ftp;
async function loadData() {
let filesSynced = await syncFTPFolder(ftpPath); //Returns an array of files synced
let token = await login();
let client = await getClient();
await registerLoaderStart();
let isFilesToLoad = await loadFilesFromFolder("rootDir/pending", manifest);
if (isFilesToLoad) {
let [funds, timeSeries, ...otherStuff] = manifest;
//Do your calls to load data
}
await finalizeFTP(ftpPath);
await registerLoaderEnd(0, null, manifest);
console.log("All Done");
}
initDataToolkitConfig("rootDir/", loadData);
In the loaderConfig_[target].json file there is now a property called enviroment. Valid values for this is DEV, STAGING and PROD; this will target api-dev.fundpress.io, api-rel.fundpress.io and api.fundpress.io respectively.
Before updating this package to a major version, make sure that you first create a branch off master (without your changes) and name this branch "versions/{v#}" where {#} is the major version number. By doing this, we can easily maintain any version of this package
Example:
FAQs
UDM Data Toolkit
We found that @kurtosys/udm_data_toolkit demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 84 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A brand-squatted TanStack npm package used postinstall scripts to steal .env files and exfiltrate developer secrets to an attacker-controlled endpoint.

Research
Compromised SAP CAP npm packages download and execute unverified binaries, creating urgent supply chain risk for affected developers and CI/CD environments.

Company News
Socket has acquired Secure Annex to expand extension security across browsers, IDEs, and AI tools.