Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
It had a very good run, and got much further than it had any right to. It is time it was put to rest. Please do not use this. There are a zillion other solutions out there that weren't made by a junior at the beginning of his career and pushed well beyond their means.
It will no longer be receiving patches. Thank you for all the downloads.
Fin-Serve is a very simple http server. Written in node with few deps, it aims to simply serve up compiled frontend assets without regards to routing. It will look in /dist for compiled assets. You should compile them before trying to run this.
npm install
will install the two deps (serve-static and finalhandler), as well as the dev deps used for testing.
npm install fin-serve
to add the package to your project. After compiling assets, NODE_ENV=production npm start
after configuring your webpack to listen to this middleware will launch a server looking at the static assets in ./dist/.
TODO: explain how to add it to the babel config.
You may pass fin-serve
additional env vars that will show up in the header to be parsed by the application later. All you need to do is append META_TAG_
to the front of whatever env var you'd like to appear as a parsable header, using a query to grab it like: document.queryselector('meta[name="YOUR_ENV_VAR"]')
.
Run npm test
after install dev dependencies.
FAQs
Simple built-asset server.
We found that fin-serve demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.