Research
Security News
Malicious npm Package Targets Solana Developers and Hijacks Funds
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
= Crazy Ivan
Crazy Ivan (CI) is simplest possible continuous integration tool.
== Usage
Create a directory where your projects will live $ mkdir /var/continuous-integration
Place some project(s) in that directory $ cd /var/continuous-integration $ git clone git://github.com/edward/active_merchant.git
Set up continuous integration for each project $ crazy_ivan setup # creates example ci scripts in # each project (see How this works)
$ crazy_ivan setup # creates the ci directory, and
# creates a configuration file,
# sets a cron job to run crazy_ivan
Manually run it once to check everything is ok $ cd /var/continuous-integration $ crazy_ivan /var/www/ci # the test reports path should be # accessible via your web server
$ open /var/www/ci/index.html # or check it through your browser
Set a cron job to run it every 15 minutes $ echo "0,15,30,45 * * * * cd /var/continuous-integration; crazy_ivan /var/www/ci" > ci.cron $ crontab ci.cron
Note that you don’t want this running too frequently; having overlapping runs is possible and would be bad.
(Functionality to have this run as a web-hook is planned.)
== How this works
crazy_ivan is executed periodically by cron
crazy_ivan looks in directories one level deeper than where it’s been called
=> asked to run in /projects /shopify looks in each /liquid of these dirs /active_merchant ========> /active_shipping
=> within each directory, it expects four executable scripts to execute at the /:
/shopify
/.ci/update
version
test
conclusion
crazy_ivan first executes update
and captures the output:
#!/usr/bin/env bash
git pull # Whatever your application # needs to do to update your # source from a repository
crazy_ivan then exectutes version
and captures the output:
#!/usr/bin/env bash
#!/usr/bin/env ruby -wKU # Get a version hash/fingerprint/id
puts git show
[/^commit (.+)$/, 1] # from your version control system
#
# (Note that this will be truncated
# to fit within a filename length.)
crazy_ivan then executes test
and captures the output:
#!/usr/bin/env bash
rake db:migrate # This task prepares the application rake test # for running tests, then runs them
At each of these three steps, the output is repackaged into a .json file to be consumed in the directory holding the static html.
crazy_ivan then executes conclusion
, passing it the same results packaged
in the .json file used in the static html view.
== Copyright and Credits
Copyright (c) 2009 Edward Ocampo-Gooding. See LICENSE for details.
Heavily inspired/first code sketch written by Tobi Lütke.
FAQs
Unknown package
We found that crazy_ivan demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
Security News
Research
Socket researchers have discovered malicious npm packages targeting crypto developers, stealing credentials and wallet data using spyware delivered through typosquats of popular cryptographic libraries.
Security News
Socket's package search now displays weekly downloads for npm packages, helping developers quickly assess popularity and make more informed decisions.