Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Fetch artifacts from taskcluster.
This is a small utility application designed to download and fetch logs from TaskCluster-based CI systems.
In particular it's built for use with Mozilla's CI and web-platform-tests CI.
tcfetch [--out-dir <path>] [--artifact-name <name>] [--filter-jobs <expression>]* <repo> <commit>
By default tcfetch is configured to fetch web-platform-tests results in wptreport format.
Valid repo
names are:
mozilla-central
, mozilla-beta
, autoland
, try
- Mozilla
repositories hosted on hg.mozilla.org.wpt
- The web-platform-tests repository.commit
must be the hash of a commit in the corresponding
repository. For Mozilla repositories the minimum commit prefix is 12
characters. For web-platform-tests, anything non-ambiguous should
work.
--out-dir
- The path to put the downloaded artifact files.
--artifact-name
- The name of the artifact to download (currently
implemented as a suffix match on the full path).
--filter-jobs
- A filter string used to select the task names to
include. This is a string that's interpreted as a regex. If the string
starts with !
, any matching jobs are excluded. If the string starts
with ^
(after removing any !
), it's used as a regexp against the
full task name, otherwise it's used as a substring match.
For example to fetch all Firefox logs from web-platform-tests commit
0f123ad and put them in a directory called logs
:
tcfetch --out-dir logs --filter-jobs '-firefox-' wpt 0f123ad
FAQs
Download log files from Taskcluster CI systems
We found that tcfetch demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.