Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
This gem wraps the Bliss.js library written by Lea Verou and makes it available to the Rails Asset Pipeline.
Add the gem to the Gemfile
in your Rails project:
gem 'blissful-rails'
Then execute:
$ bundle install
And add your favourite flavour to your application.js
file:
//= require bliss
If you want to go with the shy version (it doesn't touch the host environment,
except by adding a global variable named Bliss
), you might do want to add
this instead:
//= require bliss.shy
You might also be interested in the blissful-ujs
gem if you are looking to
replace jquery-ujs
. Read more about it
here.
If you installed this library, then you might want to visit the documentation. Basically, I might give you a tip:
$.ready().then(function () {
console.log('Ok, you\'ve loaded Bliss.js successfully!')
})
Blissful documentation mentions which jQuery methods are similar. The difference between those is the implementation: Bliss is only 3kb and might probably not work well in older browsers without polyfills.
See this if you have issues.
This gem is updated once a week. Basically, if we find changes in the JavaScript library, we will put the new JavaScript files and upload a new gem. However, the library was written for little to no maintenance, hence even if you do not see activity in a month or so, it's safe to use.
Bug reports and pull requests are welcome on GitHub at https://github.com/spicymagpie/blissful-rails.
The gem is available as open source under the terms of the MIT License.
Thanks to Lea Verou for writing the library, and to Hendrik Kleinwächter for letting me experiment a little with other things.
FAQs
Unknown package
We found that blissful-rails demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.