Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Save and restore the state of your Rails development and test databases as you work on different branches.
This allows you to make some changes to the structure of your database on a feature branch, then be able to quickly switch back to your master branch to make a hotfix or start a new feature branch with your original database structure and content.
Install the gem:
gem install branchbot
Download the post-checkout
file into the .git/hooks
directory of your project.
Modify to configure any flags.
Note: Be sure to keep the post-checkout
name to match Git's expectations.
--app-root
- The app root relative to the project root (default: '.')--db-config-erb
- Interpret database.yml as ERB an template before parsing as YML (default: disabled)Only PostgreSQL and MySQL databases are currently supported.
While this hook is geared towards Rails and depends on Ruby, it is very easy to use it in non-Ruby/Rails projects, so long as you have Ruby installed on your system.
This script will look for a config/database.yml
file in your app's root (configurable via --app-root
), and expects it to look like this:
development:
adapter: <adapter>
username: <database username>
password: <database password>
database: <database name>
We currently support two adapters: mysql2
and postgresql
. We don't actually rely on these gems, but instead use them to determine which database's command line tools we should use (mysqldump/mysql or pg_dump/psql). Use mysql2
if you are using a MySQL database, or postgresql
if you are using a PostgreSQL database.
FAQs
Unknown package
We found that branchbot demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.