
Research
Two Malicious Rust Crates Impersonate Popular Logger to Steal Wallet Keys
Socket uncovers malicious Rust crates impersonating fast_log to steal Solana and Ethereum wallet keys from source code.
bundle-version
Advanced tools
Exposes middleware and plugin that responds with Compoxure header / build number.
Middleware and plugin that provides response headers that show the bundle versions this service expects to work with.
var buildNumber = config.get('build'); // Or whatever appropriate in your environment
var buildVersion = require('bundle-version')(buildNumber, cdnUrl);
app.use(buildVersion.middleware);
Typically you would have a build number in a runtime configuration file (added to a service docker file by Jenkins for example as part of the build).
{
'build':102
}
The assetBase name can be anything you like, it defaults to 'assets', but if you use Bosco as part of your static asset pipeline will form part of the URL generation for the CDN:
{{header['x-cdn-url'] || cdnUrl }}/{{serviceName}}/{{buildVersion}}/
In the above example, the cdnBaseUrl is provided to the service via a 'x-cdn-url' header. If you do not use this header you can pass the entire cdnUrl through as the cdnUrl property when creating the middleware (no trailing slash).
If you use a combination of Bosco + Compoxure (or either), this middleware also sets a CDN Url property for you that ensures that any references to images or other items works correctly based on the service build number.
The configuration is appended to the application config, accessible on each request.
req.app.get('cdnUrl');
The configuration is appended to the pre object on the request (similar to a pre handler).
request.pre.cdnUrl
TODO: Confirm the Hapi version actually works.
FAQs
Exposes middleware and plugin that responds with Compoxure header / build number.
We found that bundle-version demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Socket uncovers malicious Rust crates impersonating fast_log to steal Solana and Ethereum wallet keys from source code.
Research
A malicious package uses a QR code as steganography in an innovative technique.
Research
/Security News
Socket identified 80 fake candidates targeting engineering roles, including suspected North Korean operators, exposing the new reality of hiring as a security function.