Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Spree is a complete open source commerce solution for Ruby on Rails. It was originally developed by Sean Schofield and is now maintained by a dedicated core team. You can find out more about by visiting the Spree e-commerce project page.
Spree actually consists of several different gems, each of which are maintained in a single repository and documented in a single set of online documentation. By requiring the Spree gem you automatically require all of the necessary dependency gems. Those gems are as follows:
All of the gems are designed to work together to provide a fully functional e-commerce platform. It is also possible, however, to use only the pieces you are interested in. So for example, you could use just the barebones spree_core gem and perhaps combine it with your own custom authorization scheme instead of using spree_auth.
Start by adding the gem to your existing Rails 3.x application's Gemfile
gem 'spree'
Update your bundle
bundle install
Then use the install generator to do the basic setup (add Spree to Gemfile, etc.)
rails g spree:site
Now its time to install all of the necessary migrations, assets, etc.
rake spree:install
If you'd like to also install sample data and images you can follow up the above command with:
rake spree_sample:install
Now you just need to run the new migrations
rake db:migrate
rake db:seed
If you also want some sample products, orders, etc. to play with you can run the appropriate rake task.
rake db:sample
The source code is essentially a collection of gems. Spree is meant to be run within the context of Rails application. You can easily create a sandbox application inside of your cloned source directory for testing purposes.
Clone the git repo
git clone git://github.com/spree/spree.git spree
cd spree
Install the gem dependencies
bundle install
Create a sandbox rails application for testing purposes (and automatically perform all necessary database setup)
rake sandbox
Start the server
cd sandbox
rails server
If you want to run all the tests across all the gems then
$ cd spree
$ rake spec #=> 'this will run spec tests for all the gems'
$ rake cucumber #=> 'this will run cucumber tests for all the gems'
$ rake #=> 'this will run both spec and cucumber tests for all the gems'
Each gem contains its own series of tests, and for each directory, you need to do a quick one-time creation of a test application and then you can use it to run the tests. For example, to run the tests for the core project.
$ cd core
$ rake test_app
$ rake spec
$ rake cucumber
$ rake #=> 'this will run both spec and cucumber tests for the gem'
# If you want to run specs for only a single spec file
$ bundle exec rspec spec/models/state_spec.rb
# If you want to run a particular line of spec
$ bundle exec rspec spec/models/state_spec.rb:7
# If you want to run a single cucumber feature
# bundle exec cucumber features/admin/orders.feature --require features
# If you want to run a particular scenario then include the line number
# bundle exec cucumber features/admin/orders.feature:3 --require features
Spree is an open source project. We encourage contributions. Please see the contributors guidelines before contributing.
The Github team has also been kind enough to write up some great documentation on working with pull requests. Contributions should be performed on topic branches in your personal forks - just issue your pull requests from there. We're also asking that you continue to log important issues for non-trivial patches in our lighthouse repository. You can just link the pull request in the ticket (and link the ticket in the pull request.)
FAQs
Unknown package
We found that My-Commerce demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.