Research
Security News
Threat Actor Exposes Playbook for Exploiting npm to Build Blockchain-Powered Botnets
A threat actor's playbook for exploiting the npm ecosystem was exposed on the dark web, detailing how to build a blockchain-powered botnet.
caa-playbooks
Advanced tools
This repo provides a CLI for running through different scenarios in the form of a 'do-nothing' script. It provides a series of terminal based prompts that guide you through different scenarios. Over time, we can choose to evolve these scripts so that they actively mitigate the situation - i.e they may evolve to accept credentials and perform tasks at key points in the prompt sequence.
Install the package globally
npm install -location=global @ovotech/caa-playbooks
Then you should have the playbooks
command available on your command line
Just fire the commands above, and it should guide you through the rest. The first prompt picks the scenario you want assistance with. Under the hood, this loads a subsequent set of prompts which are configured in the ./src/scenarios
directory.
Future scenarios can be added to this and included in the options
The prompts in this repo are created with Inquirer: https://www.npmjs.com/package/inquirer Scenarios are created by creating an Inquirer prompt with arrays of Question objects. For linear sequences, there are a couple of utility functions to enforce the sequence, and to restart the prompt if any step fails.
forceSequence
- this ensures that the next question in the sequence is only shown if the previous step was confirmed. It requires each question to be named thus: stepX
- i.e step1
, step2
retryIfAnyFalse
- will restart the prompt loop from the beginning.
dlq
You can build the package using the npm run watch
or npm run build
command.
You can then test it locally by running npm link
in the project directory
FAQs
command line tools for caa
We found that caa-playbooks demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A threat actor's playbook for exploiting the npm ecosystem was exposed on the dark web, detailing how to build a blockchain-powered botnet.
Security News
NVD’s backlog surpasses 20,000 CVEs as analysis slows and NIST announces new system updates to address ongoing delays.
Security News
Research
A malicious npm package disguised as a WhatsApp client is exploiting authentication flows with a remote kill switch to exfiltrate data and destroy files.