Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
使用 dingxin-sms 前,您必须已经是阿里云注册用户,申请开通了“鼎信科技_短信通知API服务 ”,并且获得了以下关键参数:
AppCode: 阿里云应用密钥。
在命令行中输入命令(电脑已经安装 gems 命令行工具)
gem install dingxin-sms
在应用的 Gemfile 文件中添加 Ruby Gems 安装源:
gem 'dingxin-sms' # Ruby Gems 安装源
应用的根目录下运行:
bundle
使用 Git 将代码克隆到本地后使用 Rake 命令安装
git clone https://github.com/kejincan0527/dingxin-sms.git
cd dingxin-sms
rake build
rake install
安装后,如果在 irb 命令行输入命令
require 'dingxin/sms'
后,无法正确获取 Gem 引用,或者在 Rails 启动时报错提示如下:
./config/initializers/dingxin-sms.rb:1:in `<top (required)>': uninitialized constant Dingxin::Sms (NameError)
可以改为 Github 安装源,例如 Rails Gemfile 文件引用可以改为下面格式,即可正确安装。
gem 'dingxin-sms', '0.0.2', git: 'https://github.com/kejincan0527/dingxin-sms.git'
$ require 'dingxin/sms'
=> true
参数设置:
> Dingxin::Sms.configure do |config|
config.app_code = APP_CODE # 阿里云应用密钥,在阿里云控制台获取
end
返回
=> "67hbft5iouyhnjkio975rfh"
发送短信:
$ Dingxin::Sms.send(mobile, tpl_id, param)
参数说明:
在 Rails 应用目录 config/initializers/ 下创建脚本文件 dingxin-sms.rb,在文件中加入以下内容:
config/initializers/dingxin-sms.rb
Dingxin::Sms.configure do |config|
config.app_code = APP_CODE # 阿里云应用密钥,在阿里云控制台获取
end
之后,重新启动 Rails,加载配置。
在 Rails 应用中调用短信发送代码:
...
mobile = '15912345678'
tpl_id = 'TP1711063'
param = 'asin:B01E7LLKT2'
Dingxin::Sms.send(mobile, tpl_id, param)
Dingxin::Sms.long_send(mobile, tpl_id, param) # 134字符超长短信
...
按照阿里云市场鼎信科技官方接口文档提供的 SMS 样例做了 spect 测试,可以 clone 项目后,在根目录下用命令行运行以下命令测试:
$ bundle exec rspec spec
MIT 协议下的开源项目。 MIT License.
FAQs
Unknown package
We found that dingxin-sms demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.