
Research
/Security News
Critical Vulnerability in NestJS Devtools: Localhost RCE via Sandbox Escape
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
Tools for working with container types, command data operations, and concise exception handling
By using the inspectcall
library, calldecorators
decorators
can make use of call arguments to functions at runtime, and
preserves function signature metadata (which is clobbered by most
decorators) so that this functionality works even when decorators
are stacked.
The error_context
decorator uses functionality from
tdxutil.exceptions.try_with_lazy_context
to wrap a function call
in an error handler that can prepend contextual information to an
error without affecting the stacktrace. This allows errors raised
b low-level code, which may not have enough information to construct
error messages indicating what was going on, to be made far more
informative.
The debug
decorator wraps functions in a debugger post-mortem.
The debugger it uses is optionally configurable, you can
optionally set a delay so that users can bypass via keyboard
interrupt, and you can optionally toggle the behavior on and
off (for example, using global configuration).
FAQs
Tools for working with container types, command data operations, and concise exception handling
We found that calldecorators demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
Product
Customize license detection with Socket’s new license overlays: gain control, reduce noise, and handle edge cases with precision.
Product
Socket now supports Rust and Cargo, offering package search for all users and experimental SBOM generation for enterprise projects.