
Security News
Nx npm Packages Compromised in Supply Chain Attack Weaponizing AI CLI Tools
Malicious Nx npm versions stole secrets and wallet info using AI CLI tools; Socket’s AI scanner detected the supply chain attack and flagged the malware.
Should your app run in the Bundler sandbox? Well then make sure it is, let bundler-bouncer kick you out of your app if you forgot to bundle exec
it. Prevents absurdly difficult to find bugs, prevents you from propagating your system with bad data, eases the mind. In the Pragmatic Programmer, Dave Thomas and Andy Hunt say to Crash Early, because "The alternative may be to continue, writing corrupted data to some vital database" which, I did, because I wasn't using Bundler on one rake task. Then, later, when I tried to deserialize that data with Bundler running, it was invalid, sending me on a 2 day goose chase trying to figure out what was wrong. Don't let yourself get in my situation, get your app a bouncer.
If you set the environment variable USE_BUNDLER to 'no', it will warn you that it isn't using Bundler, but won't kick you out. This enables you to use tools like rubygems-bundler.
Given a Gemfile that looks like this:
source :rubygems
gem 'bundler-bouncer', '=0.1.0'
(don't forget to bundle install
)
And a main.rb that looks like this:
require "bundler/bouncer"
puts "hello world"
When you run bundle exec ruby main.rb
, your app will print hello world
, just like you'd expect.
But when you forget, and run ruby main.rb
You will get bounced out:
Try running this app again with `bundle exec`
Stick it at the top of your Rakefile.
$ gem install bundler-bouncer
FAQs
Unknown package
We found that bundler-bouncer demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Malicious Nx npm versions stole secrets and wallet info using AI CLI tools; Socket’s AI scanner detected the supply chain attack and flagged the malware.
Security News
CISA’s 2025 draft SBOM guidance adds new fields like hashes, licenses, and tool metadata to make software inventories more actionable.
Security News
A clarification on our recent research investigating 60 malicious Ruby gems.