Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
rabbit-validator
Advanced tools
Script to do basic validation on definitions.json
file for RabbitMQ for GitOps:
a-z0-9:_./\-*#
,usage.json
usage.json
should contain json array of following objects:
{ vhost: string, queue: string }
if the entry represents interacting with queue directly or{ vhost: string, exchange: string, queue: string }
if the entry represents interacting with queue through an exchange.Such statistics can be fetch from Prometheus API for example.
# Install from npm and run
npx rabbit-validator <path/definitions.json> [<path/usage.json>]
npm i rabbit-validator # install locally
npx rabbit-validator <path/definitions.json> [<path/usage.json>]
# or to force npx offline:
npx --offline rabbit-validator <path/definitions.json> [<path/usage.json>]
# --offline is not required if previously installed, but errors if
# it isn't instead of downloading the package
npm i --global rabbit-validator # install with "--global" flag puts it to path
rabbit-validator <path/definitions.json> [<path/usage.json>]
git clone git@github.com:rauno56/rabbit-validator.git
cd rabbit-validator
npx . <path/definitions.json> [<path/usage.json>]
The utility is configured via environment variables:
RABVAL_STRING_ALLOW
: a comma-separated list of names to allow through the name validation regardless of their value.FAQs
Validator for the definition files of RabbitMQ
We found that rabbit-validator demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.