Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
glowing-disco-brummm
Advanced tools
Name | Required | Description | Default Value |
---|---|---|---|
NODE_ENV | Y | Node environment value, i.e. `dev`, `test`, `prod | |
LOG_LEVEL | Y | Log level value, i.e. `error`, `warn`, `info`, `verbose`, `debug` | |
DB_HOST | Y | Hostname for the database server. | |
DB_PORT | Y | Port for the database server. | |
DB_USER | Y | User for the database. | |
DB_PASSWORD | Y | Password for the database user. | |
DB_DATABASE | Y | Database to connect to on the database server. | |
DB_SCHEMA | Y | Database schema used for the data source. In PostgreSQL, this will be `public` unless a schema is made explicitly for the service. | |
REDIS_HOST | Y | Hostname of the Redis server. | |
REDIS_PORT | Y | Port to connect to the Redis server over. | |
REDIS_URL | Y | Fully composed URL for Redis connection. Used instead of other settings if set. | |
REDIS_PASSWORD | Y | Password for Redis if authentication is enabled. | |
REDIS_DATABASE | Y | Database within Redis to connect to. | |
JWT_PRIVATE_KEY | Y | Asymmetric signing key of the JWT token. | |
JWT_PUBLIC_KEY | Y | Verifying signed JWT Token. | |
JWT_SECRET | Y | Symmetric signing key of the JWT token. | |
JWT_ISSUER | Y | Issuer of the JWT token. | |
USER_TEMP_PASSWORD | N | Temporary password that can be used during development. | |
GOOGLE_AUTH_URL | N | Google OAuth2.0 authorization URL if authentication strategy is set to Google | |
GOOGLE_AUTH_CLIENT_ID | N | Google client ID for the service | |
GOOGLE_AUTH_CLIENT_SECRET | N | Google client secret for the service | |
GOOGLE_AUTH_TOKEN_URL | N | Google OAuth2.0 authorization URL if authentication strategy is set to Google | |
GOOGLE_AUTH_CALLBACK_URL | N | Google callback URL for the client configuration in Google | |
FORGOT_PASSWORD_LINK_EXPIRY | N | Expiration period of temporary password in seconds. 1800 seconds (30minutes) is the default. | 1800 |
KEYCLOAK_HOST | N | Hostname of the Keycloak instance | |
KEYCLOAK_REALM | N | Realm (tenant) in Keycloak | |
KEYCLOAK_CLIENT_ID | N | Keycloak client ID for the service | |
KEYCLOAK_CLIENT_SECRET | N | Keycloak client secret for the service | |
KEYCLOAK_CALLBACK_URL | N | Keycloak callback URL for the client configuration in Google | |
HTTPS_PROXY | N | Https proxy url for keycloak auth |
FAQs
testing if table tag works in npm readme
We found that glowing-disco-brummm demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.