Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Infisical is a simple, end-to-end encrypted (E2EE) platform that enables dev teams to sync and manage their environment variables.
Infisical enables dev teams to pull and inject environment variables directly from the platform into their local processes just by modifying their start/dev scripts. This provides the following benefits:
It also supports git-like pull/push commands to sync and share .env files manually via CLI if needed.
As a prerequisite step, head over to https://infisical.com to make an account and create a workspace for your project. Once you've made an account, populate the workspace with your environment variables and invite your team.
Infisical works with many commands including node, nodemon, next, etc. by pulling and injecting secrets into your local environment during development. Assuming that you’ve nodemon installed, go ahead and modify the dev script in your package.json as follows:
"scripts": {
...
"dev": "npx infisical dev nodemon index.js"
}
Note: You can specify which environment you wish to pull and inject your variables from; options include dev, staging, and prod.
Next, start your dev process. If it’s your first time, then follow the prompt to log in and connect the project to your workspace:
npm run dev
Voila, you’re now automatically pulling and injecting secrets into your local environment every time you run your dev script!
Feel free to check out the full usage documentation and list of commands here.
Infisical uses end-to-end encryption to securely store and share secrets. It uses secure remote password (SRP) to handle authentication and public-key cryptography for secret sharing and syncing; your secrets are symmetrically encrypted at rest by keys decryptable-only by intended parties in your team. Put simply, we've put measures in place so that secrets remain your-eyes-only - all while making minimal user-experience trade-offs.
For a fuller discussion on how it works, head to our website: https://infisical.com/
FAQs
Sync .env files simply, securely
The npm package infisical receives a total of 35 weekly downloads. As such, infisical popularity was classified as not popular.
We found that infisical demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.