Research
Security News
Malicious npm Package Targets Solana Developers and Hijacks Funds
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
This was originally built for Anonybuzz and is now used at StarTalent. This gem provides a robust mechanism to validate email addresses and restrict account creation to corporate email accounts.
This gem also ships with a data-set of free and disposable email domains which are used for validation checks.
You can also block certain usernames from creating accounts. Examples: admin, root
Add this line to your application's Gemfile:
gem "email_check"
To validate just the format of the email address
class User < ActiveRecord::Base
validates_email :email
end
To validate that the domain has a MX record:
validates_email :email, check_mx: true
To validate that the email is not from a disposable or free email provider:
validates_email :email, not_disposable:true, not_free:true
To validate that the domain is not blacklisted:
validates_email :email, not_blacklisted:true
To validate that the username is not blocked
validates_email :email, block_special_usernames:true
Everything together:
validates_email :email,
check_mx: true,
not_disposable:true,
not_free:true,
not_blacklisted:true,
block_special_usernames:true,
message: "Please register with your corporate email"
To turn everything on by default, you can use the validates_email_strictness helper.
# Example above
validates_email_strictness :email
# Everything but allow free emails. This is what most people would want to use
validates_email_strictness :email, not_free:false
The lists are exposed as assignable arrays so you can customize them or load whatever data you please.
Add a config/intializers/email_check.rb
# Set disposable email domains
EmailCheck.disposable_email_domains = ['freemail.org']
# Append to the whitelist
EmailCheck.whitelisted_domains << 'gmail.com'
EmailCheck.free_email_domains << 'thenewgmail.com'
# Setting a domain in the blacklist will also blacklist all subdomains
EmailCheck.blacklisted_domains << 'lvh.me'
# Block the 'anonymous' username for all domains
EmailCheck.blocked_usernames << 'anonymous'
This gem is tested with Rails 4.0+. Ruby versions tested:
Rails versions tested: Rails 4.0 Rails 5.0 Rails 6.0
git checkout -b my-new-feature
)git commit -am 'Add some feature'
)git push origin my-new-feature
)FAQs
Unknown package
We found that email_check demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
Security News
Research
Socket researchers have discovered malicious npm packages targeting crypto developers, stealing credentials and wallet data using spyware delivered through typosquats of popular cryptographic libraries.
Security News
Socket's package search now displays weekly downloads for npm packages, helping developers quickly assess popularity and make more informed decisions.