Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
archerfinley-google4r-checkout-1.0.5
Advanced tools
= google4r/checkout
google4r/checkout is a library to access the Google Checkout API.
=== License
google4r itself is distributed under an MIT style license.
However, the library includes the cacert.pem:http://curl.haxx.se/ca/cacert.pem file from the Mozilla project. This file is distributed under the MPL:http://www.mozilla.org/MPL/.
== More Information
You can find more information on the Google Checkout API here:http://code.google.com/apis/checkout/developer/index.html. Note that the API documentation assumes an understanding of the Google Checkout XML API.
== Google Checkout Tests
You have to place a file called 'frontend_configuration.rb' in the directory'test' with the configuration for the Google4R::Checkout::Frontend class to use for running the tests.
The file should contain content similar to:
FRONTEND_CONFIGURATION = { :merchant_id => '', :merchant_key => '', :use_sandbox => true }
== Dependencies
The unit tests use Mocha so you have to install the gem "mocha" to run the tests. You will also need the money gem library.
== How To: Freeze a google4r version in a Rails project
rake rails:freeze:gems
only works for the Rails gems. So, how do you freeze your own gems like google4r? It turns out to be pretty straightforward:
cd RAILS_ROOT cd vendor gem unpack google4r-checkout ls
Then, open RAILS_ROOT/config/environment.rb in your favourite text editor and add the following lines at the top of the file just below require File.join(File.dirname(FILE), 'boot')
:
Dir.glob(File.join(RAILS_ROOT, 'vendor', '*', 'lib')) do |path| $LOAD_PATH << path end
Now you can use the following in your own code:
require 'google4r/checkout'
FAQs
Unknown package
We found that archerfinley-google4r-checkout-1.0.5 demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.