
Research
Malicious fezbox npm Package Steals Browser Passwords from Cookies via Innovative QR Code Steganographic Technique
A malicious package uses a QR code as steganography in an innovative technique.
refs-compiler
Advanced tools
Compiler for YAML, JSON and INI files using path references
# npm
# global
$ npm install -g refs-compiler
# dev dependency
$ npm install refs-compiler --save-dev
# Yarn
# global
$ yarn global add refs-compiler
# dev dependency
$ yarn add refs-compiler -D
AWSTemplateFormatVersion: '2010-09-09'
Resources:
- $ref: ./relative/path/to/file.yaml
RolePolicies:
$ref: ./resources/role-policies.yaml
Type: 'AWS::IAM::Policy'
Properties:
PolicyName: custom-role
Roles:
- custom-role
PolicyDocument:
Version: '2012-10-17'
Statement:
-
Sid: PassRole
Effect: Allow
Resource:
-
'Fn::Join':
- ""
-
- 'arn:aws:iam::'
-
Ref: 'AWS::AccountId'
- ':role/*'
Action:
- 'iam:PassRole'
// CommonJS
const path = require('path');
const { default: compiler } = require('refs-compiler');
// ES6
import path from 'path';
import compiler from 'refs-compiler';
const inputTemplate = path.resolve('/path/to/template.yaml');
const outputFile = path.resolve(`/path/to/output.yaml`);
try {
compiler(inputTemplate, outputFile)
.then(results => {
console.log(`file created in ${results.outputFile}`);
})
.catch(error => {
console.log(`An error occurred while writing the file: ${error.message}`);
console.log(error.stack);
});
} catch (e) {
console.error(e.message);
console.error(e.stack);
}
$ refs-compiler -o ./build/output.yaml ./templates/template.yaml
AWSTemplateFormatVersion: '2010-09-09'
Resources:
- RolePolicies:
Type: 'AWS::IAM::Policy'
Properties:
PolicyName: custom-role
Roles:
- custom-role
PolicyDocument:
Version: '2012-10-17'
Statement:
- Sid: PassRole
Effect: Allow
Resource:
- 'Fn::Join':
- ''
- - 'arn:aws:iam::'
- Ref: 'AWS::AccountId'
- ':role/*'
Action:
- 'iam:PassRole'
The base code was borrowed from doublenot/refs and then refactored / rewritten to support NodeJS 8+ using native Promises + async/await
FAQs
Compiler for YAML, JSON and INI files using path references
The npm package refs-compiler receives a total of 21 weekly downloads. As such, refs-compiler popularity was classified as not popular.
We found that refs-compiler demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
A malicious package uses a QR code as steganography in an innovative technique.
Research
/Security News
Socket identified 80 fake candidates targeting engineering roles, including suspected North Korean operators, exposing the new reality of hiring as a security function.
Application Security
/Research
/Security News
Socket detected multiple compromised CrowdStrike npm packages, continuing the "Shai-Hulud" supply chain attack that has now impacted nearly 500 packages.