
Research
Two Malicious Rust Crates Impersonate Popular Logger to Steal Wallet Keys
Socket uncovers malicious Rust crates impersonating fast_log to steal Solana and Ethereum wallet keys from source code.
create-diagnose
Advanced tools
Helped me debug/understand how npm create
worked, and align behavior across
pnpm/yarn/npm etc. Probably not useful to you unless you're creating a create-*
module.
npm create diagnose
# do some guesses as to what package manager and create command you likely wanted to use
npm create -- --guess
npm create diagnose@latest --some-npm-flag -- --non-npm-flag
--
gets passed to create-diagnose
command (expected)process.env.npm_command
: init
(alias of create
)process.env.npm_lifecycle_event
: npx
process.env.npm_lifecycle_script
: create-diagnose
pnpm create diagnose@latest --some-npm-flag -- --non-npm-flag
--
process.env.npm_config_user_agent
: (eg) pnpm/10.7.1 npm/? node/v22.14.0 darwin arm64
yarn create diagnose@latest --some-npm-flag -- --non-npm-flag
[…].yarn/bin/create-diagnose@latest: No such file or directory
yarn create diagnose --non-npm-flag
process.env.npm_config_user_agent
: (eg) yarn/1.22.22 npm/? node/v22.14.0 darwin arm64
bun create diagnose@latest --some-npm-flag -- --non-npm-flag
--
process.env.npm_config_user_agent
(eg) bun/1.2.12 npm/? node/v22.6.0 darwin arm64
process.env.npm_command
: exec
process.env.npm_lifecycle_event
: bunx
process.env.npm_lifecycle_script
: create-diagnose@latest
MIT-licensed. See LICENSE.
FAQs
Debug npm `create` commands (well, understand them)
The npm package create-diagnose receives a total of 0 weekly downloads. As such, create-diagnose popularity was classified as not popular.
We found that create-diagnose demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Socket uncovers malicious Rust crates impersonating fast_log to steal Solana and Ethereum wallet keys from source code.
Research
A malicious package uses a QR code as steganography in an innovative technique.
Research
/Security News
Socket identified 80 fake candidates targeting engineering roles, including suspected North Korean operators, exposing the new reality of hiring as a security function.