
Research
Malicious fezbox npm Package Steals Browser Passwords from Cookies via Innovative QR Code Steganographic Technique
A malicious package uses a QR code as steganography in an innovative technique.
If you are hosting your Rails app on ECS Fargate and want to connect to the Rails console or launch a bash session, you need to use AWS cli like so :
aws ecs execute-command --region eu-west-3 --cluster CLUSTER_ARN --task TASK_ARN --container CONTAINER_NAME --command 'bundle exec rails console' --interactive
This gem helps to get the correct cluster arn and task id so that you don't have to get them yourself.
ecs console
ecs bash
Install AWS cli
Install AWS Session Manager plugin
Install gem
gem install 'ecs-rails'
Via environment variables:
export ENV['AWS_REGION'] = 'us-east-1'
export ENV['AWS_ACCESS_KEY_ID'] = 'your-access-key-id'
export ENV['AWS_SECRET_ACCESS_KEY'] = 'your-secret-access-key'
export ENV['CONTAINER_NAME'] = 'your-container-name'
# config/initializers/ecs-rails.rb
EcsRails.aws_region = 'us-east-1'
EcsRails.aws_access_key_id = ENV['AWS_ACCESS_KEY_ID']
EcsRails.aws_secret_access_key = ENV['AWS_SECRET_ACCESS_KEY']
EcsRails.container_name = 'webapp'
Connect to Rails console on a running Task.
ecs console
Select a cluster:
1) cluster-prod
2) cluster-staging
Choose 1-2 [1]:
Select a service:
1) app
2) worker
Choose 1-2 [1]:
irb(main)>
You can specify cluster name via -c option by giving a string included in cluster arn. You can specify service name via -s option by giving a string included in service arn.
# with cluster name: webapp-cluster-prod-e950a13
# with service name: webapp-app-prod-7c7cad7
ecs console -c prod -s app
irb(main)>
FAQs
Unknown package
We found that ecs-rails demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
A malicious package uses a QR code as steganography in an innovative technique.
Research
/Security News
Socket identified 80 fake candidates targeting engineering roles, including suspected North Korean operators, exposing the new reality of hiring as a security function.
Application Security
/Research
/Security News
Socket detected multiple compromised CrowdStrike npm packages, continuing the "Shai-Hulud" supply chain attack that has now impacted nearly 500 packages.