Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
@travetto/boot
Advanced tools
Install: primary
$ npm install @travetto/boot
Boot is basic environment awareness coupled with typescript bootstrapping for travetto
apps and libraries. It has support for the following key areas:
The functionality we support for testing and retrieving environment information:
hasProfile(p: string): boolean;
- Test whether or not a profile is active.isTrue(key: string): boolean;
- Test whether or not an environment flag is set and is trueisFalse(key: string): boolean;
- Test whether or not an environment flag is set and is falseget(key: string, def?: string): string;
- Retrieve an environmental value with a potential defaultgetInt(key: string, def?: number): number;
- Retrieve an environmental value as a numbergetList(key: string): string[];
- Retrieve an environmental value as a listThe framework uses a file cache to support it's compilation activities for performance. This cache is also leveraged by other modules to support storing of complex calculations. AppCache
is the cache that is used specific to the framework, and is an instance of FileCache
. FileCache
is the generic structure for supporting a file cache that invalidates on modification/creation changse.
The class organization looks like:
class FileCache {
constructor(cwd: string, cacheDir?: string);
init(): void;
writeEntry(full: string, contents: string | Buffer): void;
readEntry(full: string): string;
removeExpiredEntry(full: string, force?: boolean): void;
removeEntry(full: string): void;
hasEntry(full: string): boolean;
statEntry(full: string): fs.Stats;
clear(): void;
}
Everything is based on absolute paths being passed in, and translated into cache specific files.
This functionality allows the program to opt in the typescript compiler. This allows for run-time compilation of typescript files.
FsUtil
provides some high level functionality (like recursive directory delete).
FAQs
Bootstrapping and common utilities for travetto applications.
We found that @travetto/boot demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.