Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Early checks for environment variables availability, so you don't have to. Hook
it early in your program to require or default a variable and then work with
ENV
like you normally would. Extremely useful for Twelve-Factor apps.
Add this line to your application's Gemfile:
gem 'early', require: false
Afterwards, make sure to call Early
as early as possible in your application,
to check the ENV
variables, before you use them in your configuration layer:
require 'early'
Early do
require :DATABASE_URL
require :REDIS_URL
default :PROVIDER, :generic
end
The configuration will require the presence of DATABASE_URL
and REDIS_URL
and will raise Early::Error
if any of them is missing. It will also set a
default value to the env PROVIDER
.
If you want to use early with Rails, you can store the early configuration in
config/early.rb
:
require 'early'
Early do
require :ADMIN_NAME, :ADMIN_PASSWORD
require :MEETUP_API_KEY
end
More importantly, require it in config/boot.rb
, which is executed before the
config/application.rb
and config/initializers
files:
ENV['BUNDLE_GEMFILE'] ||= File.expand_path('../Gemfile', __dir__)
require 'bundler/setup' # Set up gems listed in the Gemfile.
require 'bootsnap/setup'
require_relative 'early' # 👈
This will make sure, that the rules you wanted early to enforce have been
applied before any code in config
has been run.
If you are using Travis CI, you can auto-load the environment variables
specified in .travis.yml
with:
require 'early'
Early :development do
travis
end
The gem is available as open source under the terms of the MIT License.
FAQs
Unknown package
We found that early demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.