Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
#Absentee Camper
This gem will monitor a Campfire room for @mentions, and notify the mentioned users via email if they aren't in the room. Multiple users can be mentioned in one Campfire message, and each user will receive one notification email. The email message will contain the message that was triggered by the @mention.
gem install absentee_camper
ABSENTEE_CAMPER_CONFIG=/path/to/config absentee_camper
It is recommended to create a user for the sole purpose of monitoring the Campfire room (e.g. Campfire Bot), and use that user's API token when running Absentee Camper. The reason is that if you don't, and instead use the API token of a "real" user, that user will never be able to leave the Campfire room because Absentee Camper will be running under that user. This means that any mentions of that user won't trigger an email since they will always be present in the room.
Here is a sample config file:
---
room_id: 12345
token: 'your-token'
campfire_subdomain: 'your-subdomain'
replyto_email_domain: 'your-replyto-domain'
users:
john: 12345
steve: 678910
room_id
- The ID of the room you wish to monitor. This can be found
in the URL for the room.token
- The API token for the monitoring user.campfire_subdomain
- This can be found in the Campfire URL (e.g. subdomain.campfirenow.com)replyto_email_domain
- The subdomain you would like to appear in the
email from address.users
- Each user line consists of the name of the mention name and
that user's corresponding 37Signals Campfire user ID. One way to get
this user ID is to log into Campfire as a user that has admin privileges,
click on the Users tab, and then hover over the change link of the
user for which you want to find the user ID and take note of the number
in the path (e.g. https://your-company.campfirenow.com/member/12345/permissions).
For example, if you have a user named John Smith with a
user ID of 12345, and you want to be able to mention them as @john,
the users line in the config file would be john: 12345
.Specs!
Provide context in the notification. For example, in a Campfire session there are two users: John and Steve. Another user, Chad is not present in the room:
John Smith: Hey Steve. I am having a problem with the build.
Steve Stallion: Hey John. I don't know anything about that. You
should ask @chad. That's his department.
John Smith: Oh, I thought you were the one that handled that. OK,
I will wait for Chad's response.
Currently, the email notification that Absentee Camper sends out will only contain the second message, which doesn't have any context about what was being discussed. It would be nice to set some configuration variables that indicated you wanted to include context in the notification message, and how many lines on either side to include.
Provide a means other than email, such as text messaging, to notify the users.
Do the usual fork -> change -> pull request dance.
FAQs
Unknown package
We found that absentee_camper demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.