Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Bosco will take care of your microservices, just don't try and use him on a plane.
Bosco is an attempt to build a utility knife to help manage the complexity that using microservices, which results in a large number of code repositories, brings with it. Inspired by the Github 'setup', e.g. can a developer run one simple command and get up and running?
npm install bosco -g
bosco fly
Run this command in a folder where you want all of your projects to live. It will prompt you for some information, and then save this configuration in this based folder, in future always run bosco from here.
It will ask initially for:
This is then saved in a configuration file, default is in .bosco/bosco.json, so all subsequent commands use it.
{
"github": {
"organization": "TSLEducation",
"authToken": "2266b8xxxxxxxxxxxxxxxxxxxxxa84a5f9",
"team": "southampton-buildings",
"repos": [
"infra-ansible-configuration",
"infra-aws",
"infra-bootstrap",
"infra-cabot",
"infra-defcon-agent",
"infra-dns",
"infra-dockerfiles"
]
}
}
Bosco will also include any configuration in a file in the .bosco folder with the same environment as NODE_ENV. This allows you to manage things like AWS keys for publication of assets into different environments.
The default command, this sets you up.
bosco fly
This will clone all the repositories in your team, and then run npm install on all of them. If the repository already exists locally it will skip it. To have it update the repository with changes, just add 'pull' to the command, and it will issue a 'git pull --rebase' on all the projects before npm install.
bosco fly pull
This will create bundles for front end assets (JS, CSS, Templates).
bosco s3push
This command requires that you have configured your AWS details for S3. Best to put these into your .bosco folder in a per environment config, e.g. .bosco/development.json.
{
"aws":{
"key": "XXXXXX",
"secret": "XXXXXX",
"bucket": "bucket-name",
"region": "eu-west-1",
"cdn":"https://dudu89lpwit3y.cloudfront.net"
}
}
To then access the html fragments for PC, it follows a simple convention:
For example:
This would contain a fragment that has script tag for all of the minified JS tagged in the bottom group.
This will aggregate and serve all of the static assets (those compiled by Face) on a single pseudo CDN url.
bosco cdn
If services want to take part in the static asset part, they need a bosco-service.json config file.
e.g.
{
"assets": {
"basePath": "/src/public",
"js": {
"bottom": [
"js/lib/base64.min.js",
"js/lib/bind.shim.min.js",
"js/lib/cookies.min.js",
"js/lib/lean-modal.min.js",
"js/report-review.js",
"js/resources.js"
],
"top": [
"js/event-tracking.js"
]
},
"css": {}
}
}
To then access the html fragments for PC, it follows a simple convention:
For example:
This would contain a fragment that has script tags for all of the JS tagged in the bottom group.
FAQs
Bosco will take care of your microservices, just don't try and use him on a plane.
The npm package bosco receives a total of 22 weekly downloads. As such, bosco popularity was classified as not popular.
We found that bosco demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.