Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
sg1-platform
Advanced tools
This node package enables developers to build micro-frontend platforms using React. Inspired by micro-service architectures, this approach splits the front-end into separate modules to be developed and deployed independently from one another.
SG1 was inspired by Shipt's desire to migrate from a monolith application to one which could easily be maintained by devlopers across many teams. After searching for the right solution, we found that there really weren't any good approaches in the developer community for solving this problem and decided to build SG1. It is comprised of popular, open-source frameworks to help teams of developers rapidly build applications using a modular, micro-frontend architecture.
The SG1 platform is comprised of several node packages with @shipt/sg1
at its core.
@okta/okta-react
@shipt/nova
axios
react-router-dom
styled-components
The following environment variables must be set in SG1 Apps.
Name | Default | Description |
---|---|---|
REACT_APP_CDN | https://sg1-modules.staging.shipt.com | Domain hosting SG1 modules |
REACT_APP_SITE_ROOT | http://localhost:3000 | Application domain |
REACT_APP_LOCALHOSTS | [] | Alternate domains hosting SG1 modules (JSON array) |
REACT_APP_OAUTH_URL | https://shipt.okta.com | Okta OAuth URL |
REACT_APP_OAUTH_ISSUER | https://shipt.okta.com/oauth2/aus4lad0y7z7crJyw2p7 | Okta OAuth issuer |
REACT_APP_OAUTH_CLIENTID | 0oa4ejb77uZEbODj92p7 | Okta OAuth client ID |
Note:
.env
files are supported via CRA
N/A
N/A
N/A
Semantic Versioning (SemVer) is used when publishing to NPM.
git clone git@github.com:shipt/sg1.git
cd sg1
npm install
npm test
npx create-react-app SG1_APP_NAME \
--scripts-version @shipt/sg1-scripts \
--template @shipt/sg1
cd SG1_APP_NAME
.env
file with the required env vars.npm start
open http://localhost:3000
npx create-react-app SG1_MODULE_NAME \
--scripts-version @shipt/sg1-module-scripts \
--template @shipt/sg1-module
cd SG1_MODULE_NAME
npm start
open http://localhost:5000/manifest.json
ESLint + Prettier is used to lint and format Typescript code according to both Shipt and the React community's best practices.
VS Code users can take advantage of the Prettier extension to automatically fix lint errors on save.
code --install-extension esbenp.prettier-vscode
The master branch is default and feature branches should be created from it for all development.
git checkout master
git pull origin master
git checkout -b GH_USER/PR_TASK/PR_FEATURE_DESCRIPTION
Jest + React Testing Library is used to verify component functionality.
SG1 itself is published as a Node package via @shipt/sg1
.
Simply build, deploy, and host the SPA as you normally would.
There are a few strings that need to be pulled to get your module into production.
SG1 is driven by a manifest that contains the module name, references to the module context and the module itself.
To deploy your module to production, those items need to be added to the manifest file. To eliminate the requirement of a human having to make changes to the manifest file, the CI process will inject that information into the manifest when a merge occurs to the master
branch.
Ensure your project's root directory contains a .npmrc
file with the latest npm token. This is required to allow private repositories to be installed in the DevOps pipeline. Check here for the latest version.
Using this as a reference build your .drone.yml
. Then I would recommend dropping the following message in the #ask-devops:
Would someone be a lamb and review the .drone.yml to be sure it is set up correctly for my module to go to production? Could you also initialize Drone for our SG1 module repo
module repo url here
One Drone is initialized and your .drone.yml
file is set up correctly, any merges to the master
branch will trigger a new build of your module and deployment to production SG1.
Code coverage should never decrease. The metrics for this are here.
FAQs
Monorepo for SG1 platform.
We found that sg1-platform demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.