Research
Security News
Malicious npm Package Targets Solana Developers and Hijacks Funds
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
Blog engine that parses Markdown files stored in Dropbox for a static blog engine.
Add this line to your application's Gemfile:
gem 'dropdown'
And then execute:
$ bundle
Or install it yourself as:
$ gem install dropdown
Create an application on Dropbox
https://www.dropbox.com/developers/apps/create
Here is a screenshot of an example of a Dropbox app creation page filled out:
Enter your Dropbox APP KEY and APP SECRET in environment variables
Once your create a Dropbox application, you will be assigned an App key and an App secret. You will want to put these values in environment variables so you can use these in your Dropdown configuration settings. We highly suggest you do not put these values straight into your configuration because you do not want them checked into your source control.
For development, we recommend using dotenv.
For Rails, add this line to your application's Gemfile
gem 'dotenv-rails', :groups => [:development, :test]
Create a .env
file to the root of your project
Add the .env
file to your .gitignore
Add the following content to your .env
file
DROPBOX_APP_KEY=<your app key>
DROPBOX_APP_SECRET=<your app secret>
DROPBOX_ACCESS_TOKEN=<your access token>
For production, if you application lives on Heroku, you can run the following:
heroku config:set DROPBOX_APP_KEY=<your app key>
heroku config:set DROPBOX_APP_SECRET=<your app secret>
heroku config:set DROPBOX_ACCESS_TOKEN=<your access token>
Update your Dropdown configuration
For Rails, create config/initializers/dropdown.rb
with the following content:
Dropdown.configure do |c|
c.dropbox_app_key: ENV['DROPBOX_APP_KEY']
c.dropdown_app_secret: ENV['DROPBOX_APP_SECRET']
c.dropdown_access_token: ENV['DROPBOX_ACCESS_TOKEN']
end
We will be retrieving the DROPBOX_ACCESS_TOKEN
with the next step.
Run rake setup:dropbox:access_token
This will instruct you to go to a Dropbox url to authorize your Dropbox application.
Copy the authorization code and enter it the console.
Your access token will be displayed and you can copy it to an environment variable: DROPBOX_ACCESS_TOKEN
.
- blog-posts |-- markdown |-- random-post-1.md |-- random-post-2.md |-- html |-- random-post-1.html |-- random-post-2.html |-- templates |-- honeysuckle.handlebars |-- .index
A rake task will be used to process a directory with Markdown files. The process will read each Markdown file and create an accompanying static file in HTML. This process will use RedCarpet to parse the markdown files and generate HTML files.
# task to process the Markdown directory
require 'dropdown/processor'
task :process [:source, :destination] do |t, args|
DropDown::Processor.new(args.source, args.destination).process
end
Additional functionality
DropDown::Processor.new.process(:all) # same as calling DropDown::Processor.new.process
DropDown::Processor.new.process # uses the source and destination directories specified in the configuration
Each file will have meta data stored as comments in the MarkDown:
Title: Deep Throat Exposed!
Author: Bob Woodward
Post: 4/4/1974
Lorem ipsum dolor sit amet, consectetur adipiscing elit. Ut volutpat molestie condimentum. Vestibulum malesuada,
lorem sit amet euismod pellentesque, tellus felis varius enim, id tincidunt leo odio aliquet ante. Maecenas metus
lorem, pretium vitae auctor sed, blandit id quam.
This will generate the following html:
<!-- Title: Deep Throat Exposed! -->
<!-- Author: Bob Woodward -->
<!-- Post: 4/4/1974 -->
<div class='post'>
<div class='title'>Deep Throat Exposed!</div>
<div class='author'>Bob Woodward</div>
<div class='post'>19740404T....</div>
<div class='content'>
Lorem ipsum dolor sit amet, consectetur adipiscing elit. Ut volutpat molestie condimentum. Vestibulum malesuada,
lorem sit amet euismod pellentesque, tellus felis varius enim, id tincidunt leo odio aliquet ante. Maecenas metus
lorem, pretium vitae auctor sed, blandit id quam.
</div>
</div>
This will also create the following row in the .index file:
title: Deep Throat Exposed! author: Bob Woodward post: 19740404T.... slug: deep-throat-exposed checksum: 384749403
DropDown.configure do |c|
c.base_path: 'blog_posts'
c.source_directory: 'markdown'
c.destination_directory: 'html'
c.template: 'honeysuckle'
c.dropbox_app_key: '<insert dropbox app key>'
c.dropbox_app_secret: '<insert dropbox app secret key>'
end
FAQs
Unknown package
We found that dropdown demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
Security News
Research
Socket researchers have discovered malicious npm packages targeting crypto developers, stealing credentials and wallet data using spyware delivered through typosquats of popular cryptographic libraries.
Security News
Socket's package search now displays weekly downloads for npm packages, helping developers quickly assess popularity and make more informed decisions.