Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
This Gem allows you to generate signed tokens that grant access to your Canvas embeds.
Your application frontend can then use these tokens in the Canvas React component to display your Canvas embeds in your application.
Each token should be configured with the set of scopes that are approriate for the user, granting them access to only their data.
If any scopes are required by your charts that are not present in the scopes payload, the request will fail.
You can view how this Gem is used in a sample rails app in the example/
directory
Add gem 'canvas-embed'
to your Gemfile, then:
# key is the private key from Canvas
# scopes is the Hash of scopes to grant the user
# expiration_seconds is the duration in seconds for the token to be valid (default is one hour)
# user_id is an optional user identifier that will be used in Canvas' logging
Canvas::Embed.generate_embed_token(key, scopes, expiration_seconds, user_id)
rspec
# increment the version in version.rb
# build the new gem
rake build
# outputs new gem path eg 'canvas-embed 0.1.1 built to pkg/canvas-embed-0.1.1.gem'
# publish the new gem (need rubygems.org access) from the path above
gem push pkg/canvas-embed-0.1.1.gem
FAQs
Unknown package
We found that canvas-embed demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.