Research
Security News
Quasar RAT Disguised as an npm Package for Detecting Vulnerabilities in Ethereum Smart Contracts
Socket researchers uncover a malicious npm package posing as a tool for detecting vulnerabilities in Etherium smart contracts.
gardr-validator-web
Advanced tools
Description: This is the web interface for the garðr validator project.
The main purpose is to find possible errors or regressions in display ads. Its intended to grow over time to a set of rules based on best practices for performance ( although displayads not necessarily can avoid document.write atm ).
The validator takes input as a scripturl or zipfile, html,css and javascript, and produces in 3 steps harvested data and a report.
It uses phantomJS as a browser, loads in a shim on top of the PhantomJS api, runs for a 10 seconds after all hooks have been innjected and data colelcted. After phantomjs run, the preoprocessors and validators/rules runs in a series to generate a report(info, warn, debug, error...).
Install depedencies and package validator with package gardr(abit funky)
$ npm install
Run tests
$ npm test
Run server:
$ PORT=8000 npm start
Local development:
( if editing gardr-validator, run ´npm link´ in gardr-validator folder, and then link gardr-validator inside gardr-validator-web with ´npm link gardr-validator´)
$ npm run start-dev
If you need to debug output from phantomjs, add env variable TMP_DIR=/TMP_DIR.
Screenshots and json output from phantom will be outputted in a folder with id as name.
You can configure port, logfile location, etc using the config module or by specifying environment variables when starting.
$ HTTP_PORT=1337 LOG_FILE_NAME=~/mylogs/pvw npm start
Create a github issue.
YES, pull requests with tests. Be sure to create a issue and let us know you are working on it - maybe we can help out with insights etc.
(please let us know of alternatives to this project)
! Prerequisite: Get your ssh-key added to our server at admin@git.gardr.org.
As the setup is Ubuntu with Dokku, you can SSH into git.gardr.org and use the dokku CLI, ref https://github.com/progrium/dokku. Added a couple of Dokku-plugins for rebuild and supervisord, but they are not needed.
Add dokku as remote to validator-web git-repo on your computer:
git remote add dokku@git.gardr.org:validator
Push to dokku:
git push dokku master
Redeploy via dokku / (throw away logs, files and database):
dokku rebuild:all
Run command via dokku, e.g:
dokku run validator ls -lha
To access the docker instance via ssh, first access gardr.org, then:
docker ps
Get containerId and insert in next command where "my_container_id":
PID=$(docker inspect --format '{{.State.Pid}}' my_container_id)
nsenter
will give you direct shell access to the running docker container:
nsenter --target $PID --mount --uts --ipc --net --pid
/app
folder./app/logs
.result-db-$(version)-$(enviroment)
.
phantom_output_files_$(version)_$(enviroment)
.
debug-input-$(timestamp).json
, and output-$(timestamp).json
as well as screenshots named $(width)x$(height)_$(timestamp).png
.FAQs
The Web ui for the garðr validator
The npm package gardr-validator-web receives a total of 0 weekly downloads. As such, gardr-validator-web popularity was classified as not popular.
We found that gardr-validator-web demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 4 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket researchers uncover a malicious npm package posing as a tool for detecting vulnerabilities in Etherium smart contracts.
Security News
Research
A supply chain attack on Rspack's npm packages injected cryptomining malware, potentially impacting thousands of developers.
Research
Security News
Socket researchers discovered a malware campaign on npm delivering the Skuld infostealer via typosquatted packages, exposing sensitive data.