Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
= Crazy Ivan
Crazy Ivan (CI) is simplest possible continuous integration tool.
== Usage
Create a directory where your projects will live $ mkdir /var/continuous-integration
Setup a project or two in that directory $ cd /var/continuous-integration $ git clone git://github.com/edward/active_merchant.git
Setup continuous-integration for each project $ crazy_ivan setup # creates example ci scripts in # each project (see How this works)
$ crazy_ivan setup # creates the ci directory, and
# creates a configuration file,
# sets a cron job to run crazy_ivan
Manually run it once to check everything is ok $ cd /var/continuous-integration $ crazy_ivan /var/www/ci # the test reports path should be # accessible via your web server
$ open /var/www/ci/index.html # or check it through your browser
Set a cron job to run it every 15 minutes $ echo "0,15,30,45 * * * * cd /var/continuous-integration; crazy_ivan /var/www/ci" > ci.cron $ crontab ci.cron
Note that you don’t want this running too frequently; having overlapping runs is possible and would be bad.
(Functionality to have this run as a web-hook is planned.)
== How this works
crazy_ivan is executed periodically by cron
crazy_ivan looks in directories one level deeper than where it’s been called
=> asked to run in /projects /shopify looks in each /liquid of these dirs /active_merchant ========> /active_shipping
=> within each directory, it expects three executable scripts to execute at the /:
/shopify
/.ci
update
version
test
crazy_ivan first executes update
and captures the output:
#!/usr/bin/env bash
git pull # Whatever your application # needs to do to update your # source from a repository
crazy_ivan then exectutes version
and captures the output:
#!/usr/bin/env bash
#!/usr/bin/env ruby -wKU # Get a version hash/fingerprint/id
puts git show
[/^commit (.+)$/, 1] # from your version control system
#
# (Note that this will be truncated
# to fit within a filename length.)
crazy_ivan then executes test
and captures the output:
#!/usr/bin/env bash
rake db:migrate # This task prepares the application rake test # for running tests, then runs them
At each of these three steps, the output is repackaged into a .json file to be consumed in the directory holding the static html.
== Copyright and Credits
Copyright (c) 2009 Edward Ocampo-Gooding. See LICENSE for details.
Heavily inspired/first code sketch written by Tobi Lütke.
FAQs
Unknown package
We found that edward-crazy_ivan demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.