Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
This Gem allows you to generate signed tokens that grant access to your Canvas embeds.
Your application frontend can then use these tokens in the Canvas React component to display your Canvas embeds in your application.
Each token should be configured with the set of scopes that are approriate for the user, granting them access to only their data.
If any scopes are required by your charts that are not present in the scopes payload, the request will fail.
You can view how this Gem is used in a sample rails app in the example/
directory
Add gem 'canvas-embed'
to your Gemfile, then:
# key is the private key from Canvas
# scopes is the Hash of scopes to grant the user
# expiration_seconds is the duration in seconds for the token to be valid (default is one hour)
# user_id is an optional user identifier that will be used in Canvas' logging
Canvas::Embed.generate_embed_token(key, scopes, expiration_seconds, user_id)
rspec
# increment the version in version.rb
# build the new gem
rake build
# outputs new gem path eg 'canvas-embed 0.1.1 built to pkg/canvas-embed-0.1.1.gem'
# publish the new gem (need rubygems.org access) from the path above
gem push pkg/canvas-embed-0.1.1.gem
FAQs
Unknown package
We found that canvas-embed demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.