Research
Security News
Malicious npm Package Targets Solana Developers and Hijacks Funds
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
This is the code that powers callsigns.ca. It started with the simple desire for a simple mobile friendly way of searching the Canadian Callsign Database and ended with me developing my own website.
Grab the source code:
mkdir -p /var/node && cd /var/node
git clone git://github.com/tcort/callsigns.git && cd callsigns
Install the dependencies:
npm install
Configure iptables:
iptables-restore < ./etc/iptables/rules.v4
ip6tables-restore < ./etc/iptables/rules.v6
apt-get install iptables-persistent
Configure:
$EDITOR config.json
Populate the database:
/var/node/callsigns/db/refresh.sh
Add a cron job to refresh the database:
crontab -e
15 1 * * * /var/node/callsigns/db/refresh.sh >/dev/null 2>&1
Configure rsyslog
:
sudo -e /etc/rsyslog.conf
local5.* /var/log/callsigns.log
sudo service rsyslog restart
logger -p local5.info "Test"
Get SSL Certificates:
git clone https://github.com/letsencrypt/letsencrypt
cd letsencrypt
./letsencrypt-auto --agree-dev-preview --server \
https://acme-v01.api.letsencrypt.org/directory certonly
Generate DHE Parameters:
openssl dhparam -out /etc/ssl/certs/dhparam.pem 4096
Configure nginx:
cp /var/node/callsigns/etc/nginx/sites-available/callsigns.ca /etc/nginx/sites-available/callsigns.ca
$EDITOR /etc/nginx/sites-available/callsigns.ca
systemctl restart nginx
Configure the service:
cp /var/node/callsigns/etc/systemd/system/callsigns.service /etc/systemd/system/callsigns.service
systemctl enable callsigns
systemctl start callsigns
Once the service is up and running, execute npm test
to perform some end-to-end tests.
Code License: see LICENSE.md
Data License: see Terms and Conditions on the Industry Canada website.
FAQs
Query the Canadian Amateur Radio Callsign Database
We found that callsigns demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
Security News
Research
Socket researchers have discovered malicious npm packages targeting crypto developers, stealing credentials and wallet data using spyware delivered through typosquats of popular cryptographic libraries.
Security News
Socket's package search now displays weekly downloads for npm packages, helping developers quickly assess popularity and make more informed decisions.