
Security News
Axios Maintainer Confirms Social Engineering Attack Behind npm Compromise
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.
shoebilljs
Advanced tools
Shoebill.js is an npm package that handles local authentication as well as social media authentication using passport. This package is meant to be as similar to Ruby on Rails' Devise package
* lightweight and modular authentication
* already setup encryption and sessions
* plugin and use different features such as local authentication, google authentication, facebook authentication, and more (coming soon) easily through a single command using our api
* lists routes for ease of use
* npm install shoebilljs -g
* cd into_your_project
* npm init
* npm install express mongoose passport body-parser express-session ejs bcryptjs chalk
* shoebill start <entryfile.js> <~/the_absolute_path_of_your_local_repo>
* if all files (listed below) are not automatically generated, run the above command again
* steps above must be completed
* shoebill add <social_media> <~/the_absolute_path_of_your_local_repo> , for instance shoebill add facebook ~/tumblrclone (currently we only support google and facebook oauth)
* in your views/index.ejs add <% include ./partials/<social_media>signin.ejs %>, for instance <% include ./partials/facebooksignin.ejs %>
* in your entryfile, just before app.use(express.static('public')), write: app.use('/auth/<socialmedai>/',require('./routes/<socialmedia>.routes')); for instance app.use('/auth/facebook/',require('./routes/facebook.routes'));
* Note: by running shoebill start you will overwrite any existing files by the below names
* model/user.model.js
* config/displayroutes.js - this file is used simply for viewing the available routes in the terminal
* routes/localuser.routes.js - this file is used for c.r.u.d functionalities for local users and to login
* views/index.ejs - this file is a template file for your homepage, including instructions to include premade signup or login partials in this homepage
* views/partials/signup.ejs - this file is a partial for a local signup form
* views/partials/signup.ejs - this file is a partial for a local login form
* views/profile.ejs - this file is a template file for your profile
* public/shoebill.css - this file is the styling linked in views/index.ejs
* ./<entryfile.js> - this file is created through the first parameter when you run shoebill start
* /routes/user.routes.js - this file contains the routes shared amongst all users, regardless of whether they were created locally or through oauth/passport
* ./key.js - this file contains the placeholder client_ids and secrets in the proper format, you must edit this file to use shoebill add <socialmedia>
* shoebill start <entryfile> <absolute__local_project_path> | shoebill start app.js ~/tumblrclone
* shoebill add <socialmedia> <absolute__local_project_path> | shoebill add facebook ~/tumblrclone, shoebill add google ~/tumblrclone
* Some notes on this example app:
* You can test it out by git cloning this repository, cd-ing into the repo, running npm install, and then node index.js
* This example app took me about an hour in total, linking the authentication was fairly simple and went without any issues, though I did have to comment out the fs.existsSync from the entrypoint file after I ran shoebill add google and shoebill add facebook. Other than that, it was very simple to use and basically just involved styling.FAQs
Shoebill.js is an npm package that handles local authentication as well as social media authentication using passport. This package is meant to be as similar to Ruby on Rails' Devise package
We found that shoebilljs demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.