
Security News
/Research
Wallet-Draining npm Package Impersonates Nodemailer to Hijack Crypto Transactions
Malicious npm package impersonates Nodemailer and drains wallets by hijacking crypto transactions across multiple blockchains.
Utility for caching bundled gems.
Especially useful for CI servers that rely on clean build directories, or use
multiple build directories and need to run bundle install
repeatedly.
bundle-depot fetch
bundle install --path .bundle/depot/current
bundle-depot store
This will:
Gemfile.lock
(e.g. 314ff159).bundle/depot/cache/314ff159
is created. This is the local cache.314ff159.tar.gz
. If available it is downloaded and unpacked..bundle/depot/current
to .bundle/depot/cache/314ff159
bundle install
is installing gems when both caches are cold. Otherwise, does nothing \o/.bundle/depot/cache/314ff159
into .bundle/depot/cache/314ff159.tar.gz
314ff159.tar.gz
to the remote cacheWhenever the Gemfile changes in subsequent runs this process will repeat
itself. .bundle/depot/current
will point to the cache entry that contains the
most recent bundle gems.
This can be used to setup a shared cache on the same machine by configuring the
environent variable BUNDLE_DEPOT_CACHE
.
export BUNDLE_DEPOT_CACHE=/var/lib/bundle_depot
bundle-depot fetch
bundle install --path .bundle/depot/current
bundle-depot store
Instead of using .bundle/depot/cache
this will then use /var/lib/bundle_depot
as
a shared cache folder.
When a remote store is configured this sequence will check and update a remote cache location:
export BUNDLE_DEPOT_SCP_USER=upload
export BUNDLE_DEPOT_SCP_PASS=upload
export BUNDLE_DEPOT_SCP_HOST=cache.example.com
bundle-depot fetch
bundle install --path .bundle/depot/current
bundle-depot store
In addition to checking the local cache on the file system, this will check the existance of a zipped bundle on a remote location. Currently supported is a connection via SCP.
BUNDLE_DEPOT_CACHE
Point to where you want to keep your local cache. Defaults to .bundle/depot/cache
BUNDLE_DEPOT_SCP_HOST
Activates remote cache. Sets the host the cache will be uploaded to.
BUNDLE_DEPOT_SCP_USER
and BUNDLE_DEPOT_SCP_USER
The credentials for the SCP session.
#!/bin/sh
set -o errexit # abort after the first command that fails
fmt <<'EOF'
====================================================================================
Preparing Build Agent Environment
====================================================================================
EOF
gem install bundle_depot --bindir bin --no-rdoc --no-ri
fmt <<'EOF'
====================================================================================
Bundle it!
====================================================================================
EOF
export BUNDLE_DEPOT_CACHE=/var/lib/bundle_depot
export BUNDLE_DEPOT_SCP_USER=upload
export BUNDLE_DEPOT_SCP_PASS=upload
export BUNDLD_DEPOT_SCP_HOST=cache.example.com
bin/bundle-depot fetch
bundle install --path .bundle/depot/current --frozen
bin/bundle-depot store
$ gem install bundle_depot
git checkout -b my-new-feature
)git commit -am 'Add some feature'
)git push origin my-new-feature
)FAQs
Unknown package
We found that bundle_depot demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
/Research
Malicious npm package impersonates Nodemailer and drains wallets by hijacking crypto transactions across multiple blockchains.
Security News
This episode explores the hard problem of reachability analysis, from static analysis limits to handling dynamic languages and massive dependency trees.
Security News
/Research
Malicious Nx npm versions stole secrets and wallet info using AI CLI tools; Socket’s AI scanner detected the supply chain attack and flagged the malware.