Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
activist.js is a standalone library for making your site resilient to unexpected network events.
Activist comes in 2 versions, which offer a trade-off between how much work you need to do to add the library to your site, and how many of your users will be able to take advantage of the work. New browsers provide features that make the installation of activist.js as simple as adding a script tag to your home page, however this version of the library will only work for a small percentage of your user base (up-to-date chrome users). Activist also is packaged with a drop-in application cache manifst, which will extend the benefit to most users, but can require wider site changes.
Add activist.js
to your site.
<script type='text/javascript' src='activist.js' async></script>
Add Offline Cache (recommended)
Adding an application cache manifest will allow activist.js to run on most
browsers, and is strongly recommended. Adding this cache is a 2 step
process. First, modify the html
tag of your pages to reference
the cache. It should look something like this:
<html manifest="/activist.appcache">
A sample appcache is available on activistjs.com.
The application cache needs to be served with the mime type of 'text/cache-manifest' to work on old versions of internet explorer.
More information on application cache mechanics are available on the w3 website.
Activist tries really hard to keep your content accessible in the face of adversity. In practice this results in several independent processes that kick into action when your server is unavailable.
The first line of access is to preserve a reasonable cache of your site to allow users to see existing content even if they can't get new updates. To this end, Activist maintains a cache of your content on client machines and shows that content when needed.
To retreive updates, Activist attempts to establish connectivity through CDNs and other rendezvous services. These rendezvous services update while Activist is online, and aim to force interference with a large quantity of content to successfully disrupt.
Contribution and help are welcome! activist.js development is centered on github, and open tasks can be found in the issues area of this repository.
FAQs
resilience to network interference
We found that activist demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.