
Research
/Security News
10 npm Typosquatted Packages Deploy Multi-Stage Credential Harvester
Socket researchers found 10 typosquatted npm packages that auto-run on install, show fake CAPTCHAs, fingerprint by IP, and deploy a credential stealer.
@squiz/dxp-plugin-template
Advanced tools
This tool allows developers to install plug and play components within their normal webpack repos
This is the install tool for the plug and play components. This tool can be installed in a repo as a node module or run one time via npx.
To install plug and play components via npx simply run npx git+ssh://git@gitlab.squiz.net:plug-and-play/install-tool.git this will download the install tool and run it, giving you the available components to install.
It should be noted that if you have components that clash with the selected components to install, the tool will alert you to this and suggest that you rename these folders.
You will need to run the npx command each time you wish to run the install tool.
There are two kinds of dependencies for Plug and Play components: Local and External. Local dependencies are other Plug and Play components which may be re-usable block of code used im multiple places across the P&P landscape. e.g the Video Modal component makes use of the common Modal component. External dependencies are other NPM packages which are needed for the component to function, often utility packages, e.g. the Modal component uses ally.js and focus-trap to perfom several WCAG functions.
When installing components using the Plug and Play Install Tool you will be prompted for if you want the tool to automatically install the dependencies; if you do the tool will handle the rest, if you refuse you will be prompted for each components dependency set for if you want it installed or if you will handle the dependency installation yourself.
The tool will check if a local dependency is already installed and skip if it is, this check is performed ONLY based on the /src/module/; no attempt to verify this is actually a P&P component is performed or that it is the correct version.
If you opt to install dependencies yourself you may find not all Local Dependencies are includes in the install tool options by default, to expand the full list to include dependant only modules include the --deps argument when invoking the install tool.
The install tool will not install a component or dependency if it find a like named module in /src/module, it will alert via the console that the install has been skipped. To resolve backout the changes performed by the P&P install tool, rename or move the folder(s) that are causing issues and re-installed P&P component via the tool. Once installed you can rename the P&P or existing components as needed.
#plug-and-play slack channel
FAQs
This tool allows developers to install plug and play components within their normal webpack repos
We found that @squiz/dxp-plugin-template demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 39 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Socket researchers found 10 typosquatted npm packages that auto-run on install, show fake CAPTCHAs, fingerprint by IP, and deploy a credential stealer.

Product
Socket Firewall Enterprise is now available with flexible deployment, configurable policies, and expanded language support.

Security News
Open source dashboard CNAPulse tracks CVE Numbering Authorities’ publishing activity, highlighting trends and transparency across the CVE ecosystem.