
Security News
/Research
Wallet-Draining npm Package Impersonates Nodemailer to Hijack Crypto Transactions
Malicious npm package impersonates Nodemailer and drains wallets by hijacking crypto transactions across multiple blockchains.
botium-box-basic-dist
Advanced tools
Botium Box is running on standard components available for free. You can install it on your own server (on premise), or use cloud providers for serverless installation, or even a mixture of those approaches.
Botium Box can be installed "serverless" using existing cloud services.
Get Redis - a free instance from https://redislabs.com/ as a starter. From the "Configuration" please note the Endpoint and the Redis Password for later use (you can choose any Redis username when configuring Botium Box later).
Get Prisma - a free instance running on Heroku as a starter. See here. From the Heroku Dashboard, open the "Settings" tab, then "Reveal Config Vars", the environment variable named "CONFIG" shows the "Management API Secret" - you will need this later. The Heroku endpoint is required later as well.
Fill in the environment variables from what you know from above, and afterwards navigate to the Heroku App.
Attention: the Heroku free tier is not suitable for Botium Box production usage
For hosting Botium Box as Docker, use these commands to build and run a Docker image:
> git clone https://github.com/codeforequity-at/botium-box-basic-dist.git && cd botium-box-basic-dist
> docker build --build-arg BOTIUMBOX_QUEUE_REDISURL=redis://redisuser:redispassword@redishost:redisport --build-arg PRISMA_ENDPOINT=https://my-prisma-endpoint/demo/dev --build-arg PRISMA_MANAGEMENT_API_SECRET=my-prisma-management-api-secret --build-arg PRISMA_SECRET=something123 --build-arg JWT_SECRET=something123 -t botiumbox .
> docker run -p 4000:4000 botiumbox
Botium Box will now run on http://localhost:4000
For some log output, run this command instead:
> docker run -p 4000:4000 -e DEBUG=botium* botiumbox
You can run Botium Box on your own server.
Prepare Backend services
> docker-compose up
Download and run Botium Box
> npm install -g botium-box-basic-dist
> botium-box-cli start --pe http://127.0.0.1:4466/box/dev -r redis://127.0.0.1:6379 -p 8080
> git clone https://github.com/codeforequity-at/botium-box-basic-dist.git && cd botium-box-basic-dist
> npm install
> npm run start-standalone:backend
> npm run start-standalone:frontend
Botium Box will now run on http://localhost:4000
Installation and startup can take a while, especially on first usage.
It is possible to mix the above architecture: Prisma, Redis and Botium Box are loosly coupled, you can choose whatever your infrastructure suggests as best option - Prisma and Redis in the cloud, Botium Box locally. Or run Prisma locally, Botium Box in the cloud and use an existing Redis service - it's totally up to you.
The only thing you have to make sure is connectivity between Botium Box and Prisma as well as Redis service.
Default username: "admin"
Default password: "nooneknows"
Have fun.
FAQs
Botium Box Community Edition
The npm package botium-box-basic-dist receives a total of 5 weekly downloads. As such, botium-box-basic-dist popularity was classified as not popular.
We found that botium-box-basic-dist demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
/Research
Malicious npm package impersonates Nodemailer and drains wallets by hijacking crypto transactions across multiple blockchains.
Security News
This episode explores the hard problem of reachability analysis, from static analysis limits to handling dynamic languages and massive dependency trees.
Security News
/Research
Malicious Nx npm versions stole secrets and wallet info using AI CLI tools; Socket’s AI scanner detected the supply chain attack and flagged the malware.