Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Give credit where credit is due: this gem was Inspired by Eliot Sykes' asset_fingerprinter Rails plugin. We needed something a little more robust at Poll Everywhere that would work outside of Rails in our compass/sass deploymennt pref-flight compilations, so we wrote this little honey.
Humans are stupid and sloppy, so this library is well tested via spec and put through the production ringer at Poll Everywhere.
Standalone:
gem install asset_fingerprinter
Gemfile:
gem 'asset_fingerprinter'
The Asset Fingerprint gem was designed to work in any environment including Rails and the compass compiler.
Holy Caw! We made this work with Rails 2.x because we're old school. Well, almost old school; we assume that you hacked your Rails 2.x install to use Gemfiles. Just add:
gem 'asset_fingerprinter'
to your Rails 2.x Gemfile and we take care of the rest through some hickity-hack magic.
Change the asset_path_template in config/environments/production.rb
config.action_controller.asset_path_template = AssetFingerprinter.path_rewriter
Meh, no hack wizardry here. Curse ya Rails 3!
Cool, we are too. If you want to get down and dirty with AssetFingerprint, RTFSC and discover configuration that looks like:
pr = PathRewriter.new do |pr|
pr.fingerprinter = Fingerprinter::Digest.new # Whatever, give us a proc or something that response to .call
pr.fingerprinter.root = File.dirname(__FILE__) # Turns out you need a file root for file digesting.
pr.pattern = PathRewriter::Format::Filename # Newbs use the query string cachebusters, we use use Filename rewriter, but you can go nuts here with anything that responds to .call
end
# OMG! It threw a file digest into my file name
pr.call('/images/i_am.will') # => '/images/i-am-will-fp-abc3984928abfedf3e2309sb.will'
# Heh, its not a magic bullet, You still need to configure nginx or Apache
# to rewrite this path. Its totally worth it though.
We'll entertain your pull requests if you have specs around whatever you throw our way. Otherwise we spit at you!
No, We're really interested in more fingerprinting strategies, integrations with other frameworks, and other ways that make serving up HTTP assets ubber fast.
FAQs
Unknown package
We found that asset_fingerprinter demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.