Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
= bincache
BinCache is a system designed to chache compiled binaries on S3. It has resources for bash, ruby and chef.
BinCache tracks a single directory and a series of scripts. After each script is run, the contents of the directory is cached on s3. On sequential runs, the scripts are not re-executed, but instead the cache from S3 is downloaded and placed in the directory. If a script is changed, itself and all following scripts will be re-executed. BinCache does this by hashing the current script together with all previous scripts ran and storing the resulting cache in S3 with that hash as it's name. By ensuring that scripts contain markers to introduce uniquness on different systems, you can make sure that you never have to wait twice for something to compile!
== Install
gem sources -a https://rubygems.org
gem install bincache
== Environment
Make sure you set the environment variables with something like:
export BINCACHE_S3_ACCESS_KEY=1234567890ABCDEFGHIJ
export BINCACHE_S3_SECRET_KEY=1234567890ABCDEFHIJKLMNOPQRSTUVWXYZ12345
export BINCACHE_S3_BUCKET=my_ec2_bucket
export BINCACHE_S3_PREFIX=my_bincache/
== Bash example
export PATH=$HOME/.gem/ruby/1.8/bin:$PATH
dir=/tmp/bincache
cat <<-EOF > script1 echo "I am in script one" > one EOF
cat <<-EOF > script2 echo "I am in script two" > two EOF
bincache $dir $script1 $script2
== Ruby example
require 'bincache'
dir = "/tmp/bincache"
script1 = <<EOS echo "I am in script one" > one EOS
script2 = <<EOS echo "I am in script two" > two EOS
scripts = [] scripts << script1 scripts << script2
bincache = BinCache.new bincache.run_series(dir,scripts)
== Chef example
require 'bincache'
bincache "script1" do action :run directory "/tmp/bincache" script <<-EOS echo "I am in script one" > one EOS end
bincache "script2" do action :run directory "/tmp/bincache" script <<-EOS echo "I am in script two" > two EOS end
== uniquness example
To tag a script with something unique to ensure that it is distingushible on multiple systems, you need to insert something unique into the comments. For example, you could do:
echo "I am showing you how to uniqueify your script" > example
uname -m
}lsb_release -ds
When this script is hashed, it will produce different values on different systems. With this technique, you can cache different binaries from different systems with the same code base!
== Copyright
Copyright (c) 2010 Martin Rhoads. See LICENSE for details.
FAQs
Unknown package
We found that bincache demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.