
Security News
/Research
Wallet-Draining npm Package Impersonates Nodemailer to Hijack Crypto Transactions
Malicious npm package impersonates Nodemailer and drains wallets by hijacking crypto transactions across multiple blockchains.
A bit like Make but for directories
Make works really well with file in, file out processes, but breaks down when you have directory in, directory out processes. This aim to handle that.
The dirbuild config file defines some targets (a lot like with make), where each target has:
Then, when running a target with dirbuild [mytarget]
(target is
optional, defaults to the first target in the config file), that
target is found in the config file, the dependencies are resolved and
each file is hashed. The output directory is checked for a manifest
file, if it exists with the same hashes for each file, then nothing to
do. Otherwise, runs the command, then writes the manifest file.
Named .dirbuild.yml
.
targets:
mytarget:
command: npm run build
depends:
- '*.txt' # every .txt file in the current directory
- '**/*.js' # every .js file in any subdirectory
- package.json
dependsExclude:
- node_modules/** # ignore everything in node_modules
output: build/
Generated by dirbuild
, and stored in the output directory once the
command completes at [outputDirectory]/.dirbuildManifest.yml
.
FAQs
A bit like Make but for directories
We found that dirbuild demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
/Research
Malicious npm package impersonates Nodemailer and drains wallets by hijacking crypto transactions across multiple blockchains.
Security News
This episode explores the hard problem of reachability analysis, from static analysis limits to handling dynamic languages and massive dependency trees.
Security News
/Research
Malicious Nx npm versions stole secrets and wallet info using AI CLI tools; Socket’s AI scanner detected the supply chain attack and flagged the malware.