Research
Security News
Malicious npm Package Targets Solana Developers and Hijacks Funds
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
Should your app run in the Bundler sandbox? Well then make sure it is, let bundler-bouncer kick you out of your app if you forgot to bundle exec
it. Prevents absurdly difficult to find bugs, prevents you from propagating your system with bad data, eases the mind. In the Pragmatic Programmer, Dave Thomas and Andy Hunt say to Crash Early, because "The alternative may be to continue, writing corrupted data to some vital database" which, I did, because I wasn't using Bundler on one rake task. Then, later, when I tried to deserialize that data with Bundler running, it was invalid, sending me on a 2 day goose chase trying to figure out what was wrong. Don't let yourself get in my situation, get your app a bouncer.
If you set the environment variable USE_BUNDLER to 'no', it will warn you that it isn't using Bundler, but won't kick you out. This enables you to use tools like rubygems-bundler.
Given a Gemfile that looks like this:
source :rubygems
gem 'bundler-bouncer', '=0.1.0'
(don't forget to bundle install
)
And a main.rb that looks like this:
require "bundler/bouncer"
puts "hello world"
When you run bundle exec ruby main.rb
, your app will print hello world
, just like you'd expect.
But when you forget, and run ruby main.rb
You will get bounced out:
Try running this app again with `bundle exec`
Stick it at the top of your Rakefile.
$ gem install bundler-bouncer
FAQs
Unknown package
We found that bundler-bouncer demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
Security News
Research
Socket researchers have discovered malicious npm packages targeting crypto developers, stealing credentials and wallet data using spyware delivered through typosquats of popular cryptographic libraries.
Security News
Socket's package search now displays weekly downloads for npm packages, helping developers quickly assess popularity and make more informed decisions.