
Research
/Security News
10 npm Typosquatted Packages Deploy Multi-Stage Credential Harvester
Socket researchers found 10 typosquatted npm packages that auto-run on install, show fake CAPTCHAs, fingerprint by IP, and deploy a credential stealer.
Platform is the back-end starting point for our projects here at Goosetail Labs. It works in conjunction with our [app-framework](https://github.com/goosetail/app-framework). You'll need to have [Node.js](http://nodejs.org/) and [MongoDB](http://www.mongo
#Goosetail Labs Platform
Platform is the back-end starting point for our projects here at Goosetail Labs. It works in conjunction with our app-framework. You'll need to have Node.js and MongoDB installed and running locally before you begin.
Our apps and platform can now be generated and setup automatically! Instead of doing all the house cleaning below,
you can use the goosetail-generator to clone and setup your new app. Visit the /generator directory of the internal repo for more details.
Clone the internal repo
ssh $ git clone git@github.com:goosetail/internal.git
https https://github.com/goosetail/internal.git
From the root of the internal repo, run $ cd platform and then the following commands:
npm install
npm start
That's it! Now point your browser to http://localhost:5000/rpc to make sure things are working properly.
The eventual goal is to automate everything in this section, but we aren't quite there yet. You'll need to make a few manual changes whenever you are setting up a new project. Most of which just involves replaces references to the platform with your new project name. Ideally we will get to the point where this is no longer necessary.
package.json
"name": "platform", //replace with your-app-platform
/core/config/env/default.json:
"url": "mongodb://localhost/platform" // replace platform with your-app-platform
"sessionSecret": "eWBBtJL3RDggT88hyFyd", // replace with an alphanumeric 20 character string
/core/config/env/acceptance.json:
"sessionSecret": "J7TwBdnpiLVTTXr6UpC4", // replace with an alphanumeric 20 character string
"baseUrl": "app-framework.uat-goosetail.com" // replace with your-app.uat-goosetail.com
"allowedOrigins": [
"app-framework.uat-goosetail.com", // replace with your-app.uat-goosetail.com
"platform.uat-goosetail.com" // replace with your-platform.uat-goosetail.com
]
// replace /platform with /your-platform for all 3
"url": "mongodb://10.1.1.96:27017/platform,mongodb://10.1.2.100:27017/platform,mongodb://10.1.2.101:27017/platform"
/core/config/env/mocha.json:
"url": "mongodb://localhost/platform-test" // replace platform-test with your-app-platform-test
/core/lib/session/index.js:
name: 'platform.api.sid' // replace with your-app-platform.api.sid
The app-framework is mainly a front end app, with a small server. This platform is our backend and it communicates with the app-framework via rpc. You will need both installed and running for your application to be fully functional.
The domains that can successfully make a CORs request to the platform are white-listed. These domains can be added inside core/config/default.json and core/config/production.json.
You do not need to list protocol or port, just the full domain and any subdomain if necessary.
In order to identify which applications are talking to the platform, you should create an App key for each application. You can generate an app key by browsing to (http://localhost:5000/rpc)[http://localhost:5000] and entering an app name and key under the app.createApp method. Alternatively, you can leave the appKey field blank and one will be generated for you automatically. After that, you'll need to include the app key in the header of your api calls. See the app-framework for an example.
FAQs
Platform is the back-end starting point for our projects here at Goosetail Labs. It works in conjunction with our [app-framework](https://github.com/goosetail/app-framework). You'll need to have [Node.js](http://nodejs.org/) and [MongoDB](http://www.mongo
We found that gtl-core demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Socket researchers found 10 typosquatted npm packages that auto-run on install, show fake CAPTCHAs, fingerprint by IP, and deploy a credential stealer.

Product
Socket Firewall Enterprise is now available with flexible deployment, configurable policies, and expanded language support.

Security News
Open source dashboard CNAPulse tracks CVE Numbering Authorities’ publishing activity, highlighting trends and transparency across the CVE ecosystem.