Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
contrail-lib
Advanced tools
![Contrail](https://images.robertharding.com/preview/RF/MI/HORIZONTAL/1174-3075.jpg)
Common functionality and libraries that are used throughout VibeIQ's services and apps.
Local development is largely test-driven.
When changing functionality:
contrail-api
)
npm run build
in the library your change is modifyinglib
into the node_modules
of the project you want to use the new codecore
library into the Users Service in the api
$ cp -r contrail-lib/core/lib/* \
contrail-api/services/users/node_modules/@contrail/core/lib
cd <library-to-publish>
npm version [major | minor | patch | prerelease --preid=alpha]
npm run build
npm publish
Every time you run git commit
, a pre-commit hook will run to check if the code is formatted correctly. If it is not, the commit will fail. To fix this, run npm run lint-staged:format
from the top-level directory and then try to commit again. This cannot be run within a service's directory those directories do no have lint-staged installed.
This check can be bypassed by setting the BYPASS_FORMATTING_CHEKC
to true
. The best way to do this is to set that environment variable temporarily, only for the life cycle of the commit. This reduces the likelihood of accidentally committing unformatted code.
BYPASS_FORMATTING_CHECK=true git commit -m "commit message"
FAQs
![Contrail](https://images.robertharding.com/preview/RF/MI/HORIZONTAL/1174-3075.jpg)
The npm package contrail-lib receives a total of 0 weekly downloads. As such, contrail-lib popularity was classified as not popular.
We found that contrail-lib demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.