Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
A bit like Make but for directories
Make works really well with file in, file out processes, but breaks down when you have directory in, directory out processes. This aim to handle that.
The dirbuild config file defines some targets (a lot like with make), where each target has:
Then, when running a target with dirbuild [mytarget]
(target is
optional, defaults to the first target in the config file), that
target is found in the config file, the dependencies are resolved and
each file is hashed. The output directory is checked for a manifest
file, if it exists with the same hashes for each file, then nothing to
do. Otherwise, runs the command, then writes the manifest file.
Named .dirbuild.yml
.
targets:
mytarget:
command: npm run build
depends:
- '*.txt' # every .txt file in the current directory
- '**/*.js' # every .js file in any subdirectory
- package.json
dependsExclude:
- node_modules/** # ignore everything in node_modules
output: build/
Generated by dirbuild
, and stored in the output directory once the
command completes at [outputDirectory]/.dirbuildManifest.yml
.
FAQs
A bit like Make but for directories
The npm package dirbuild receives a total of 1 weekly downloads. As such, dirbuild popularity was classified as not popular.
We found that dirbuild demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.