Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
sails-hook-docker-secrets
Advanced tools
Sails Hook to load docker secrets as a JSON object and to merge that into the sails.config object
This is a Sails.js hook that loads Docker secrets, using @cloudreach/docker-secrets to load the secrets as a JSON object, and merges them into the sails.config
object. It only works for secrets that are meant to add into the sails.config
object, just like you would pass in config overrides as runtime variables. The secrets should be named as follows: sails_myAttr
or sails_myAttr__mySubAttr
.
To test this hook, you need to manually add a test secret to /run/secrets
on your host machine:
sudo mkdir /run/
sudo mkdir /run/secrets
sudo vim /run/secrets/sails_testSecret
And in that file, place a single string that will be the value of that configuration key. The filename becomes the key, the contents of the file become the value.
If the file's name has a double underscore, that designates that the content to the right is a subattribute of the preceding section of the filename. So, for the secret stored at /run/secrets/sails_myAttr__mySubAttr
, you will end with the following be appended to sails.config
:
...
{
myAttr: {
mySubAttr: 'The value goes here'
}
},
...
Any of the values that are read in here will overwrite anything else that was previously set on the sails.config
object.
Don't worry if there are no secrets on your machine; the hook will still run but nothing will be merged into the sails.config
object.
FAQs
Sails Hook to load docker secrets as a JSON object and to merge that into the sails.config object
The npm package sails-hook-docker-secrets receives a total of 0 weekly downloads. As such, sails-hook-docker-secrets popularity was classified as not popular.
We found that sails-hook-docker-secrets demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.