Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Authorization is done with an oauth token from the FxA Oauth Server
Returns a javascipt bundle for running experiments locally.
Returns an object mapping configuration variables to values based on currently running experiments. Only variables affected by experiments are returned therefore the result may be an empty object.
Parameters
Authorization is optional. When used the service stores which experiments the user
is enrolled in, so the enrolled
parameter is not required.
The user
id from the oauth token is made available to experiments automatically
if the request is authenticated, so it does not need to be set in the subject
curl -v \
-X POST \
-H "Content-Type: application/json" \
-H "Authorization: Bearer 558f9980ad5a9c279beb52123653967342f702e84d3ab34c7f80427a6a37e2c0" \
"https://ab.accounts.firefox.com/v1/fxa_content_server/variables" \
-d '
{
"subject": {
"postId": 123
},
"enrolled": ["test1"]
}
'
A json object with zero or more keys
{
"highlyExperimentalFeatureEnabled": true,
"fontSize": 12
}
Same as /v1/{ app }/variables
but only returns the variable
specified.
curl -v \
-X POST \
-H "Content-Type: application/json" \
-H "Authorization: Bearer 558f9980ad5a9c279beb52123653967342f702e84d3ab34c7f80427a6a37e2c0" \
"https://ab.accounts.firefox.com/v1/foo/variables/colorScheme" \
-d '
{
"subject": {
"postId": 123
},
"enrolled": ["test1"]
}
'
A json object with zero or more keys
{
"colorScheme": "spacegray"
}
Get all the subject attributes used by the current set of experiments
curl -v "https://ab.accounts.firefox.com/v1/foo/attributes"
An array of subject attribute names
["uid","sessionId"]
FAQs
A/B testing server
The npm package able receives a total of 1 weekly downloads. As such, able popularity was classified as not popular.
We found that able demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.