Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
You must first have a Blitline.com account to successfully use the gem. You can obtain one (free) by going to http://www.blitline.com
Once you have your account, you will need to find you APPLICATION_ID which you can get by logging in and clicking on the Account tab.
In you application environment, install the Blitline gem or add the Blitline gem to your Gemfile
$ gem install blitline
or...if you have a Gemfile
gem 'blitline'
Note: We have changed our recommended method of submitting Blitline jobs to just submitting job hashes instead of building objects through an object model. This is because the Blitline API changes and evolves faster than people can/want to update their gems. Old ways will still work, they will just not be used in documentation going forward. Since Blitline works via a JSON API, it is easier to understand the hierarchy of the job when viewed as a hash. (You can find some old object based documentation here)
Learn more about job hashes and see some related JSON examples
Once the gem is installed, you can start a Rails console and try the following:
$ blitline_service = Blitline.new
$ blitline_service.add_job_via_hash({
"application_id"=>"YOUR_APP_ID",
"src"=>"http://cdn.blitline.com/filters/boys.jpeg",
"functions"=>[
{
"name"=>"resize_to_fit",
"params"=>{
"width"=>100
},
"save"=>{
"image_identifier"=>"MY_CLIENT_ID"
}
}
]
})
$ blitline_service.post_jobs
The resulting JSON will look something like:
{"results":{"images":[{"image_identifier":"MY_CLIENT_ID", "s3_url":"http://s3.amazonaws.com/blitline/9393939393/99/6CPGskk11mM-B8zaCYUJzqbw.jpg"}] ,"job_id":"4JVyFJBIhlpHNXLK-YClq5g"}}
This JSON contains:
image_identifier
, which is the image_identifier
you used in the save
params.s3_url
which is the final destination of the image (once it is done processing).This result does not indicate that the job is done! The job has been put on a queue and will be done shortly. The best
way to identify when the job is completed is by adding a postback_url
to the job hash and we will call back that url
when we have completed the image processing.
As an alternative to blitline_service.post_jobs, you can use blitline_service.post_job_and_wait
$ blitline_service.post_job_and_wait_for_poll
Which will block, and using Blitline's long polling functionality, return when the job is completed. There must be only one requested job. The returned result will look like
{"original_meta"=>{"width"=>720, "height"=>540}, "images"=>[{"image_identifier"=>"MY_CLIENT_ID", "s3_url"=>"http://s3.amazonaws.com/blitline/2013082822/20/7J6Izja0hkG7rvNj-MUJDfQ.jpg", "meta"=>{"width"=>100, "height"=>75}}], "job_id"=>"9hgxoQ10WI7YN2QcioUarbA"}
This JSON contains:
In fact, this result will contain all the exact same information a Blitline postback would contain.
The example above is a trivial (and pretty uninteresting) demonstration of how to use the Blitline gem. You can find documentation about Blitline.com and it's services by following the links below
FAQs
Unknown package
We found that blitline demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.