Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
DorIndexing is a Ruby gem that creates Solr documents from Cocina objects for the purposes of indexing. It was extracted from DOR Indexing App.
In our previous architecture, rolling indexing was performed on the Dor Indexing App server. This was inefficient and slow, as it required API calls to Dor Services App to retrieve Cocina items.
Gemifying the creation of Solr documents allows changing the architecture such that rolling indexing is performed on the Dor Services App server. This allows the more efficient retrieval of Cocina items via direct ActiveRecord db access.
Further, it allows other indexing (e.g., via RabbitMQ messages) to continue on the Dor Indexing App server.
Install the gem and add to the application's Gemfile by executing:
$ bundle add dor_indexing
If bundler is not being used to manage dependencies, install the gem by executing:
$ gem install dor_indexing
DorIndexing requires interaction with the SDR workflow API and also needs the following:
require 'dor_indexing'
doc = DorIndexing.build(
cocina_with_metadata:,
workflow_client:,
cocina_finder:,
administrative_tags_finder:,
release_tags_finder:
)
We build and update the Solr index via dor-indexing-app amd dor-services-app, both of which use this gem for indexing logic.
Argo is the blacklight app that uses the Solr index extensively, and it already has the docker containers to create new test objects in dor-services-app and index them (via dor_indexing_app to Solr). And Argo is the app built on top of the Solr index, so a good place to check results.
To ensure our indexing behavior produces the desired results, it was easiest to put the full stack integration tests in the argo repository -- they can be found in https://github.com/sul-dlss/argo/tree/main/spec/features/indexing_xxx_spec.rb
FAQs
Unknown package
We found that dor_indexing demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.