
Security News
The Hidden Blast Radius of the Axios Compromise
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.
heavily based on the code from [streisand](https://github.com/StreisandEffect/streisand).
heavily based on the code from streisand.
space elevator sets up a remote server that acts as your SSB identity. this allows you to run some of the SSB apps over SSH and the database is kept on the remote host. space elevator might be for people who fall into these categories:
before anything, you need to have git, nvm (node version manager), pip, and python (2.7)
you also need your ssh key present in ~/.ssh/id_rsa.pub.
then, to provision a new space elevator server, run:
npx spel provision
it will ask about what platform to setup on and necessary auth keys, etc.
after it's done, you can run a supported ssb app (like patchbay) with this command:
npx spel <appname>
(see below for support apps). after you exit the SSB app, space elevator deletes the local ~/.ssb folder, but keeps the app files for quicker startup next run.
for debugging purposes, you can access your server with:
ssh spaceman@<public ip>
the public IP of the server is saved in ~/.space-elevator/ip.
if you want to delete local remnants of a provisioning, run npx spel cleanup. this will not delete entities in the cloud -- that has to be done manually.
mostly for testing purposes, npx spel agnostic is also a valid command (after provisioning), which does the following:
this way you could potentially spin up an unsupported app and it should connect properly to the space elevator ssb instance on 8008.
MIT
FAQs
heavily based on the code from [streisand](https://github.com/StreisandEffect/streisand).
The npm package spel receives a total of 2 weekly downloads. As such, spel popularity was classified as not popular.
We found that spel demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.