Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
IS
sue R
endering EN
gine
ISREN is a tool aimed at providing an easy interface for pulling issue data out
of a hosted Git implementation. ISREN will pull all of the issues for the given
<hosted_git_url>
provided at run-time. For repeatable data transformations, a
transform system is available for writing custom middleware.
$ isren -h
Usage: isren [options] <hosted_git_url>
isren - ISsue Rendering ENgine
Options:
-v, --version output the version number
-a, --auth <token> Hosted git API authentication token
-k, --insecure Ignore SSL certificate check
-d, --debug Enable debug mode
-t, --transform <transform file path> Path to custom transform file
-o, --out <Output file format> The format of output file
--out-options <Output options> Additional options for output configuration
--issue-options <Issue options> Additional options for the Issue pulling
-f, --file <Output file path> The path of output file
-h, --help output usage information
Output a CSV file:
$ isren -o csv,file -f output.csv https://gitlab.com/mygroup/exampleproject
Use a custom transform and output a JSON file:
$ isren -f /path/to/transform.js -o json,file -f output.json https://gitlab.com/mygroup/exampleproject
Data flow within ISREN can be visualized with the following graphic. For every change to the internals, the graphic should be updated, see CONTRIBUTING.md
Configuration for ISREN is controlled by CLI parameters and/or a .env
file.
CLI parameters override any configuration set inside your .env
, so params can
be used for one-off changes to normal runs of ISREN.
To get started with a .env
file, you can copy the .env.example
file:
$ cp .env.example .env
AUTH
GITLAB_URL
DEBUG
ISSUE_OPTIONS
OUTPUT_OPTIONS
-v, --version
-a, --auth
-k, --insecure
-d, --debug
-t, --transform
-o, --out
Note: The order of the outputs is important! Data flows from the first defined output to the last, each output requires that the preceding output returns expected input data. Because of this, some outputs cannot be used together, the input/output must match for each output, e.g.
-o csv,file
works, but-o csv,json
does not.
--out-options
Enable additional output options for the session
Additional output file options, currently only used for CSV export types.
This value is expected to be a valid JSON object using
these options.
For example, to change the CSV delimiter to |
:
// CLI
--out-options='{"delimiter": "|"}'
// .env
OUTPUT_OPTIONS={"delimiter": "|"}
--issue-options
Additional filtering for issue fetching. This value is expected to be a valid JSON object using these filtering options. For example, to filter based on creation date:
// CLI
--issue-options='{"created_after": "2019-08-01T00:00:00.000Z"}'
// .env
ISSUE_OPTIONS={"created_after": "2019-08-01T00:00:00.000Z"}
-f, --file
-h, --help
Transforms are a powerful concept in ISREN that allow us to transform issues, one at a time, to shape the internal data into a format that better serves us.
For example, given the following example issue:
{
"id": 12345,
"description": "lorem ipsum ..."
}
If we wanted to re-key the id
to say issue_id
, we can use write the
following transform
// MyTransform.js
//
// usage:
// $ isren --transform path/to/MyTransform.js
(function(issue) {
// Add/edit our new field.
issue.issue_id = issue.id;
// Delete the old field
delete issue.id;
// Return the modified issue.
return issue;
});
When a transform, one or more, is provided, each issue is run through the transform before it goes through the output method, another type of transform! Currently, only synchronous transforms are supported.
[1.0.0 - 01/07/2020]
FAQs
isren - ISsue Rendering ENgine
The npm package isren receives a total of 3 weekly downloads. As such, isren popularity was classified as not popular.
We found that isren demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.