Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
This package contains the memfault
CLI tool.
The purpose of the tool is to make integration with Memfault from other systems, like continuous integration servers, as easy as possible.
Install the tool and run memfault --help
for more info!
upload-software-version-sbom
command. Look at the
SBOM docs for more info.Add a user-agent string to chunk POST requests to identify CLI version used for diagnostics.
Fixups with ruff (RET504)
Add an option --no-check-uploaded
for upload-mcu-symbols
to skip an
initial check if the symbol file already exists. This option should be used
with Org Tokens limited to only uploading symbol file
Bump urllib3 dependency to 1.26.19
Fixups with ruff 0.4.10
memfault console
command, to
indicate how to exit the console (Ctrl-]
).upload-elf-symbols
command for uploading ELF files with debug symbols
built outside of a Yocto environmentupload-elf-coredump
for uploading a Linux coredump to Memfaultupload-aosp-symbols
would fail when uploading too many files
at once.upload-yocto-symbols
would fail when some files in the
tarballs provided did not have the read permission set.upload-custom-data-recording
to print a more helpful error message when
exceeding device rate limits.Note: this release is marked as 1.0.0
but does not contain any breaking
changes! The version number was bumped to reflect the maturity of the tool.
upload-mcu-symbols
to skip uploading if the symbol file has already been
uploaded, and return a zero exit code in this case--deactivate
option to deploy-release
, which disables a release
for a cohortextra-metadata
option to upload-ota-payload
to attach custom
metadata to that OTA release. The metadata will be returned from Memfault
Cloud when fetching the latest Android OTA release.console
command to read SDK exported chunks via a serial port and
automatically upload to Memfault.--project
or --org
argumentsclick
when the CI
environment variable is
set, for consistent output formattingupload-yocto-symbols
subcommand to take two
image paths as required arguments; one for the root filesystem image, and
another for the debug filesystem image. Versions 0.14.0 and lower used to take
a guess at the path of the debug filesystem image from the value passed to the
--image
param. To avoid confusion and to support all configurations, the
Memfault CLI no longer does any guessing and now takes two separate params:
--image
and --dbg-image
post-chunk
subcommand to split uploads into batches of 500
chunks per upload, to avoid timing out when uploading very large chunk logsupload-debug-data-recording
to
custom-data-recording
upload-debug-data-recording
for uploading debug data
files.note
sectionFAQs
Memfault CLI tool
We found that memfault-cli demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.