
Security News
/Research
Wallet-Draining npm Package Impersonates Nodemailer to Hijack Crypto Transactions
Malicious npm package impersonates Nodemailer and drains wallets by hijacking crypto transactions across multiple blockchains.
# install cli
npm install -g knop-cli
# or using knop-cli with npx
npx -p knop-cli knop
# create an operator projet into my-operator directory (package name)
npx -p knop-cli knop new operator --name MyOperator
# add a controlled crd (api)
npx -p knop-cli knop new api --api-version svc.docaposte.cloud/v1alpha1 --kind Elasticsearch
# add the corresponding crd controller (api)
npx -p knop-cli knop new crd-controller --api-version svc.docaposte.cloud/v1alpha1 --kind Elasticsearch
# run operator in dev mode
npm run dev
npm run dev
: start operator locally (uses ~/.kube/config
for connecting to cluster)npm run dk:build
: Build docker operator imagenpm run clean
: remove artifacts (coverage, tmp, compiled files)npm run test
: run tests (jest)npm run test:watch
: run tests with watchingnpm run lint
: check code with eslintnpm run build
: build (compile) operator sources filesnpm run build:watch
: build with watchingGenerate a new node project for an operator
knop new operator --name "MyOperator"
only name is required.
parameter | value |
---|---|
name | Humanized operator name, (underscore + dash for package name) |
orgName | Humanized Organization name |
org | npm organization |
repo | git repository |
dockerRepo | docker repository |
Generate a new CRD (yaml files & types)
knop new api --api-version svc.docaposte.cloud/v1alpha1 --kind Elasticsearch
api-version & kind are required
parameter | value |
---|---|
api-version | kubernetes api version with group (ex svc.docaposte.cloud/v1alpha1) |
kind | kubernetes kind |
Generate a new CRD Controller, handle CR create/update/delete with deduplication (dosent fire if CR doesn't change)
knop new crd-controller --api-version svc.docaposte.cloud/v1alpha1 --kind Elasticsearch
api-version & kind are required (refers to managed CRD)
parameter | value |
---|---|
api-version | kubernetes api version with group (ex svc.docaposte.cloud/v1alpha1) |
kind | kubernetes kind |
# In a generated application (with at least an API)
# Register CRDs first
kubectl apply -f ./deploy/crds/*_crd.yaml
# Deploy operator (need docker image)
kubectl apply -f ./deploy/*.yaml
Variable | Default | Info |
---|---|---|
NODE_ENV | null | |
LOGGER_LEVEL | info | see pino level |
LAST_CONFIG_ANNOTATION | knop.skimia.org/last-applied-configuration | annotation used in resource for storing changes |
WATCH_NAMESPACE | null | When deployed it take the namespace of pod |
REGISTER_CRD | 0 | Unused now, create CRD in kubernetes at startup (update if exists) |
FAQs
Kubernetes operators made easy
The npm package knop receives a total of 3 weekly downloads. As such, knop popularity was classified as not popular.
We found that knop demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
/Research
Malicious npm package impersonates Nodemailer and drains wallets by hijacking crypto transactions across multiple blockchains.
Security News
This episode explores the hard problem of reachability analysis, from static analysis limits to handling dynamic languages and massive dependency trees.
Security News
/Research
Malicious Nx npm versions stole secrets and wallet info using AI CLI tools; Socket’s AI scanner detected the supply chain attack and flagged the malware.