Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
google-cloud-secrets-manager
Advanced tools
This Node.js project demonstrates how to create and retrieve secrets from Google Cloud Secrets Manager.
Before you begin, make sure you have the following:
Install project dependencies:
npm install google-cloud-secrets-manager
To use the different functions in this project, you need to set up the following environment variables:
GCP_USER: Your Google Cloud Platform user (email) associated with the project. GCP_KEY: The path to your GCP service account key file (JSON file). GCP_PROJECT_NAME: The name of your GCP project where Secrets Manager will be used.
You can set these variables by creating a .env file in the root of the project:
GCP_USER=your-user@example.com
GCP_KEY=/path/to/your/key.json
GCP_PROJECT_NAME=your-project-name
Make sure to replace the values with your actual GCP information.
The project provides the following functionalities:
Creating a new secret in Google Cloud Secrets Manager. Retrieving the value of a secret. To run the code demonstrating these functionalities, use the following commands:
Create a secret:
const secretsStore = new SecretsStore();
await secretsStore.storeCredential('secretId', 'secret', {'label1':'labelValue1', 'label2':'labelValue2'});
Get the value of a secret:
const secretsStore = new SecretsStore();
await secretsStore.retrieveCredential('secretId');
Update the value of a secret:
const secretsStore = new SecretsStore();
await secretsStore.updateCredential('secretId', 'newSecret');
FAQs
Google Cloud Secrets Manager Operator
The npm package google-cloud-secrets-manager receives a total of 0 weekly downloads. As such, google-cloud-secrets-manager popularity was classified as not popular.
We found that google-cloud-secrets-manager demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.