Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
A command line tool to detect inappropriate language in your code.
The command line tool scans a set of files for inappropriate language and prints violation messages to the console. Each inappropriate word is associated to one or more violation categories. For example, you might associate the word "beefcake" with the violation category "sexist". You can use your own custom dictionary to specify words that cause violations.
> solemn -f ./app/**/*.*
> solemn -f ./app/**/*.css -json
-f, --files <pattern> [<pattern>]* A list of glob patterns for the files
you want searched. Example:
./app/**/*.js ./app/**/*.css
-d, --dictionary <path> A file path to a dictionary. If this
option is not used, it will use a
default dictionary. The custom
dictionary file is a JSON file
containing a single JSON object. The
keys of the object are words in the
dictionary and the values for each key
is an array of category tags. Example:
{"hell": ["religious", "rude"], "babe":
["sexist"]}
-j, --json Output violations to the console as
JSON.
Each custom dictionary is a JSON file with the following format:
{
"word1": ["category1", "category3"],
"word2": ["category2"],
"word3": ["category1"]
"word4": ["category2", "category3", "category4"]
}
Every word must have at least one violation category. If multiple dictionaries are specified, words and their categories are merged.
To test the module, run the follow from the command line:
npm test
FAQs
A command-line tool that detects inappropriate language in your code.
The npm package solemn-cli receives a total of 1 weekly downloads. As such, solemn-cli popularity was classified as not popular.
We found that solemn-cli demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.