Research
Security News
Malicious npm Package Targets Solana Developers and Hijacks Funds
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
As our [education marketplace](https://www.apprentus.com) grew, we faced a dilemma: we had little visibility into our data.
As our education marketplace grew, we faced a dilemma: we had little visibility into our data.
Questions such as "who is our best customer?", "which target countries are gaining in sales?" or "what are our most popular categories for paid leads?" required tinkering in the Rails console or writing custom stats pages. We lost a lot of developer time over the years.
So we started looking for the best Business Intelligence solution out there.
Unfortunately, they all had their problems. Some required knowledge of SQL. Some made multi-table data exploration a pain. Most cost an arm, a leg and an iPhone. Per month.
The best tool we found was Looker, but at a monthly price equal to our burn rate, it wouldn't work.
So I decided to re-implement the essential parts of Looker as an open source alternative.
Insights is a desktop or self-hosted "SQL-not-required" data analytics and business intelligence tool. Featuring linkable URLs, easy data exploration, automatic joins, graphs, exports, facets (pivots), saveable views, pretty colors and a ridiculously permissive license (MIT).
It's a work in progress and you're brave for checking it out! Cheers!
To install, run:
npm install -g insights
insights # run the electron version
insights --server # run the server
Similar to Looker and their LookML, insights lets you to define your data model in a file called insights.yml
.
If this file is not found, we try to autodetect your database schema and connections.
You can use the insights_export
gem to generate this file from your Rails Models. Adapters for other frameworks coming soon.
You keep this file with your code and update it whenever something changes. You edit it to add custom fields (e.g. full_name: first_name || ' ' || last_name
), hide existing fields (e.g. encrypted_password
) or hide entire models.
When your database changes, run rake insights:export
and the file is updated automatically.
One entry in this file looks like this:
Order:
enabled: true # set to false to hide
model: Order
table_name: orders
primary_key: id
columns:
id:
type: number
index: primary_key
total_price:
type: number
hidden_field: false # this stays hidden
currency:
type: string
# ...
custom:
total_price_in_eur:
sql: "$$.total_price * $$.currency_to_eur"
type: number
links:
order_lines:
model: OrderLine
model_key: order_id
my_key: id
user:
model: User
model_key: id
my_key: user_id
You give this insights.yml
file and a database connection to insights
and start exploring.
The point is this: your developers update the .yml
file. Your CEO and CFO browse the interface. If they ask for a report, you send them a link to the right view and they can explore further.
Play with the demo here and try to answer the following questions:
Hint: to count rows, select the id
field and then count
from the table header.
FAQs
Desktop and Self-Hosted "SQL-not-required" data analytics and visualisation tool.
The npm package insights receives a total of 4,339 weekly downloads. As such, insights popularity was classified as popular.
We found that insights demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
Security News
Research
Socket researchers have discovered malicious npm packages targeting crypto developers, stealing credentials and wallet data using spyware delivered through typosquats of popular cryptographic libraries.
Security News
Socket's package search now displays weekly downloads for npm packages, helping developers quickly assess popularity and make more informed decisions.