Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Adds jobs for cortex, mend and sonarqube to the pipelines, the jobs add the gitlab url of the hosting repository as a project tag on Mend, a project link in Sonarqube or open-api info in Cortex so that reporting can correlate tools by use of the gitlab url as the key.
Add the following lines to your .gitlab-ci.yml file:
include: # add to your includes
- project: j.rivera/api-tools
file: gitlab-ci-includes.yml
ref: 53444d03851ffed62f457b8ad2aa6950f894d3aa
stages:
- code_tools # add to your stages
That will add under the stage code_tools
the jobs for Cortex (cortex_project
), Mend (mend_project
) and Sonarqube (sonarqube_project
) to decorate those tools' projects with the url of the gitlab repository.
Next add environment variables needed by the jobs. Ask for help on it on slack channel #bet-tribe-odds-devops:
APICLIENTS_TOKEN
a gitlab access token for the repository Api ClientsCORTEX_API_KEY
Cortex API keyMEND_ORG_TOKEN
Mend organization token. Defaults to value of variable WHITESOURCE_ORG_TOKEN
MEND_PRODUCT
Mend product name. Defaults to value of WHITESOURCE_PRODUCT
MEND_PROJECT
Mend project name. Defaults to value of WHITESOURCE_PROJECT_NAME
MEND_USER_KEY
Mend user key. Defaults to value of WHITESOURCE_USER_KEY
SQ_PROJECT
Sonarqube project key. Defaults to value of SONAR_PROJECT_KEY
SQ_TOKEN
Sonarqube tokenSQ_USER
Sonarqube userTo override the jobs declare them in your .gitlab-ci.yml
, in the examples below other variables' values are passed to the jobs:
cortex-project:
extends: .cortex-project-decoration
variables:
CORTEX_API_KEY: $CORTEX_TOKEN
mend-project:
extends: .mend-project-decoration
variables:
MEND_ORG_TOKEN: $MEND_ORG_TOKEN
MEND_PRODUCT: $MEND_PRODUCT
MEND_PROJECT: $MEND_PROJECT_NAME
MEND_USER_KEY: $MEND_USER_KEY
sq-project:
extends: .sq-project-decoration
variables:
SQ_PROJECT: $SONARQUBE_PROJECT_KEY
SQ_TOKEN: $SONARQUBE_TOKEN
SQ_USER: $SONARQUBE_USER
Install the ruby gem with:
$ gem install api-clients
Or add to your application's Gemfile by executing:
$ bundle add api-clients
$ bundle install
Or install it from code, for that read below.
To play with the ruby code first install the gem.
To use cortex:
$ bundle exec bin/console
irb > cortex = Api::Clients::Cortex.new gitlab_url: "https://gitlab.example.com/j.rivera/my-test-service"
=>
#<Api::Clients::Cortex:0x00005629f898d488
...
irb > cortex.update_service!
=> nil
irb > cortex.service_info
=>
{"info"=>
{"title"=>"odds-devops-test-service",
"description"=>"Test service for Odds devops tasks",
"x-cortex-git"=>
{"gitlab"=>
{"repository"=>"j.rivera/my-test-service"}},
"x-cortex-tag"=>
"oddsdevops_jrivera-my-test-service"},
"openapi"=>"3.0.1",
"servers"=>[{"url"=>"/"}]}
To use Mend:
export MEND_ORG_TOKEN=...
export MEND_USER_KEY=...
$ bundle exec bin/console
irb > mend = Api::Clients::Mend.new gitlab_url: "https://gitlab.example.com/j.rivera/my-test-service", product: "devops", project: "jrivera_my-test-service"
=>
#<Api::Clients::Mend:0x00005629f897ca48
...
irb(main):010:0> mend.tag_project!
=>
{"projectTagsInfo"=>
{"name"=>"jrivera_my-test-service",
"token"=>
"1da9c170adeb421a89a9c4157acba3b30fe5856c02114536990eee8f17c87c7d",
"tags"=>
{"gitlab-url"=>
"https://gitlab.example.com/j.rivera/my-test-service"}}}
irb > mend.project_tags
=>
{"gitlab-url"=>
["https://gitlab.example.com/j.rivera/my-test-service"]}
To use Sonarqube:
export SQ_TOKEN=...
export SQ_USER=...
$ bundle exec bin/console
irb > sq = Api::Clients::Sonarqube.new gitlab_url: "https://gitlab.example.com/j.rivera/my-test-service", project: "jrivera_my-test-service"
=>
#<Api::Clients::Sonarqube:0x00005629f8248830
...
irb > sq.link_project!
=> nil
irb > sq.project
=> "jrivera_my-test-service"
irb(main):005:0> sq.project_links
=>
[...
{"id"=>"AYmrhzwtxhyS1ZWWXNJ5",
"name"=>"gitlab-url",
"type"=>"gitlab-url",
"url"=>
"https://gitlab.example.com/j.rivera/my-test-service"}]
After checking out the repo, run bin/setup
to install dependencies. Then, run rake test
to run the tests. You can also run bundle exec bin/console
for an interactive prompt that will allow you to experiment.
TODO test instructions
To install this gem onto your local machine, run bundle exec rake install
.
To release a new version, update the version number in version.rb
, and then run bundle exec rake release
, which will create a git tag for the version, push git commits and the created tag, and push the .gem
file to rubygems.org.
Update ruby code in directory lib/api/
, in file lib/api/clients/version.rb
increase version (0.0.1 in the example), then build it with:
bundle
gem build api-clients.gemspec
Install it locally to test:
sudo gem install --local api-clients-0.0.1.gem
Push it to rubygems for usage in pipelines:
gem push api-clients-0.0.1.gem
Tag the version:
git tag 0.0.1
git push --tags
``
## Contributing
Bug reports and pull requests are welcome on GitHub at https://github.com/[USERNAME]/api-clients.
## License
The gem is available as open source under the terms of the [MIT License](https://opensource.org/licenses/MIT).
FAQs
Unknown package
We found that api-clients demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.