
Research
Malicious fezbox npm Package Steals Browser Passwords from Cookies via Innovative QR Code Steganographic Technique
A malicious package uses a QR code as steganography in an innovative technique.
Bitbucket2 is a wrapper gem for the BitBucket API - exploiting the new (2.0) version, and support for OAuth2.
It leverages Restroom (a wrapper meta gem) which was built in parallel to Bitbucket2.
Add this line to your application's Gemfile:
gem 'bitbucket2'
And then execute:
$ bundle
Or install it yourself as:
$ gem install bitbucket2
Use the Bitbucket2::Client class to get all public repositories like this:
Bitbucket2::Client.new.repositories.all
To collect private data, pass an oauth_token into the configuration:
Bitbucket2.configure do |config|
config.stack = -> (faraday) {
#faraday.use :http_cache, store: cache_store
faraday.request :oauth2, valid_oauth_token
faraday.response :logger
}
end
Bitbucket2::Client.new.repositories.all
These tokens can be collected in a variety of ways - the Rakefile provides a number of tasks to facilitate this.
If you have client credentials for BitBucket's OAuth service, you can put them in defaults.yml
like this:
credentials:
key: <key>
secret: <secret>
...and then run rake oauth
- you'll be guided through an authentication cycle and at the end your defaults.yml
will have an access token in it.
rake console
will then allow you to use that token in a prebuilt client object, via a helper method at Bitbucket2.default_client
.
After checking out the repo, run bin/setup
to install dependencies. Then, run rake rspec
to run the tests. You can also run bin/console
for an interactive prompt that will allow you to experiment.
To install this gem onto your local machine, run bundle exec rake install
. To release a new version, update the version number in version.rb
, and then run bundle exec rake release
, which will create a git tag for the version, push git commits and tags, and push the .gem
file to rubygems.org.
Bug reports and pull requests are welcome on GitHub at https://github.com/fairfaxmedia/bitbucket2.
The gem is available as open source under the terms of the MIT License.
FAQs
Unknown package
We found that bitbucket2 demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
A malicious package uses a QR code as steganography in an innovative technique.
Research
/Security News
Socket identified 80 fake candidates targeting engineering roles, including suspected North Korean operators, exposing the new reality of hiring as a security function.
Application Security
/Research
/Security News
Socket detected multiple compromised CrowdStrike npm packages, continuing the "Shai-Hulud" supply chain attack that has now impacted nearly 500 packages.