Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
This gem is a bundler plugin that can add testing, linting, and security frameworks to a Ruby gem project.
This project is similar to the RailsBytes project which helps add configuration to a Rails project.
GemBytes scripts are run via the bundler gem-bytes
command:
bundler gem-bytes PATH_OR_URI
where PATH_OR_URI
identifies a gem-bytes script.
See the repository of GemBytes scripts for publicly available GemBytes scripts.
NOTE: the GemBytes repository is not yet active. For now, you will have to bring your own script
Install the bundler gem-bytes
command as follows:
bundle plugin install bunder-gem_bytes
The bundler gem-bytes
command requires exactly one argument, which can either be a
file path or a URI to a script. The script will be loaded and executed within the
context of your project.
bundler gem-bytes PATH_OR_URI
where PATH_OR_URI
is either a local file
path or a remote URI.If the file or URI cannot be loaded, an error message will be printed to stderr
,
and the command will exit with a status code of 1
.
After checking out the repo, run bin/setup
to install dependencies. Then, run
rake
to run all the tests that will be run in the continuous-integration
workflow. You can also run bin/console
for an interactive prompt that will allow
you to experiment.
To debug this gem it is recommended that you create a test project and install this plugin with bundler from source code as follows:
# 1. Create a temp directory for testing (from the root directory of the project)
mkdir temp
cd temp
# 2. Create an new, empty RubyGem project to test
BUNDLE_IGNORE_CONFIG=TRUE bundle gem foo --no-test --no-ci --no-mit --no-coc --no-linter --no-changelog
cd foo
# 3. Install the plugin from source
BUNDLE_IGNORE_CONFIG=TRUE bundle plugin install --path ../.. bundler-gem_bytes
# 4. Create a gembytes script to add a development dependency on rubocop
cat <<SCRIPT > gem_bytes_script.rb
add_dependency :development, "rubocop", "~> 1.6"
SCRIPT
# 5. Modify code, set breakpoints, or add binding.{irb|pry} calls to the source
# 6. Run the plugin
BUNDLE_IGNORE_CONFIG=TRUE bundle gem-bytes gem_bytes_script.rb
# Repeat 4 - 6 until satisified :)
To release a new version of this gem, run create-github-release [TYPE]
where
TYPE is MAJOR, MINOR, or PATCH according to SemVer based on the changes that
have been made since the last release:
This command must be run from the project root directory with a clean worktree on the default branch.
Bug reports and pull requests are welcome on GitHub at https://github.com/main-branch/bundler-gem_bytes. This project is intended to be a safe, welcoming space for collaboration, and contributors are expected to adhere to the code of conduct.
All commit messages must follow the Conventional Commits standard. This helps us maintain a clear and structured commit history, automate versioning, and generate changelogs effectively.
To ensure compliance, this project includes:
A git commit-msg hook that validates your commit messages before they are accepted.
To activate the hook, you must have node installed and run npm install
.
A GitHub Actions workflow that will enforce the Conventional Commit standard as part of the continuous integration pipeline.
Any commit message that does not conform to the Conventional Commits standard will cause the workflow to fail and not allow the PR to be merged.
All pull requests must be merged using rebase merges. This ensures that commit messages from the feature branch are preserved in the release branch, keeping the history clean and meaningful.
The gem is available as open source under the terms of the MIT License.
Everyone interacting in the Bundler::GemBytes project's codebases, issue trackers, chat rooms and mailing lists is expected to follow the code of conduct.
FAQs
Unknown package
We found that bundler-gem_bytes demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.