
Security News
Follow-up and Clarification on Recent Malicious Ruby Gems Campaign
A clarification on our recent research investigating 60 malicious Ruby gems.
A rubygem for enabling Gemfiles to specify gem locations from environment variables.
$ gem install envandle
Enclose your Gemfile's code with an envandle block.
require "envandle"
binding.envandle do
source "https://rubygems.org"
gem "mygem", "~> 1.0"
end
Set the environment variables.
export ENVANDLE_GEM_PATH=mygem:/path/to/mygem
And execute Bundler.
$ bundle
You can specify the gem method's path
option by setting the ENVANDLE_GEM_PATH variable.
For example,
ENV["ENVANDLE_GEM_PATH"] = "mygem:/path/to/mygem"
binding.envandle do
source "https://rubygems.org"
gem "mygem", "~> 1.0"
end
is evaluated as:
gem "mygem", path: "/path/to/mygem"
If the variable is not set,
ENV["ENVANDLE_GEM_PATH"] = ""
binding.envandle do
source "https://rubygems.org"
gem "mygem", "~> 1.0"
end
is evaluated as:
gem "mygem", "~> 1.0"
You can specify the gem method's git
and branch
options by setting the ENVANDLE_GEM_GIT_BRANCH variable.
For example,
ENV["ENVANDLE_GEM_GIT_BRANCH"] = "mygem:https://github.com/mosop/mygem.git#edge"
envandle do
source "https://rubygems.org"
gem "mygem", "~> 1.0"
end
is evaluated as:
gem "mygem", git: "https://github.com/mosop/mygem.git", branch: "edge"
If the variable is not set,
ENV["ENVANDLE_GEM_GIT_BRANCH"] = ""
binding.envandle do
source "https://rubygems.org"
gem "mygem", "~> 1.0"
end
is evaluated as:
gem "mygem", "~> 1.0"
You can specify the gem method's git
and ref
options by setting the ENVANDLE_GEM_GIT_REF variable.
ENV["ENVANDLE_GEM_GIT_REF"] = "mygem:https://github.com/mosop/mygem.git#aed3d9b9965b6938cca7490e98423cf9b5908b09"
You can also specify a gemspec not a single gem.
For example, if your gem's name is "mygem", the gemspec refers the a, b and c gems and the c's version requirement is "~> 1.0",
ENV["ENVANDLE_GEM_PATH"] = "a:/path/to/a;b:/path/to/b"
binding.envandle do
source "https://rubygems.org"
gemspec
end
is evaluated as:
gem "mygem", path: "."
gem "a", path: "/path/to/a"
gem "b", path: "/path/to/b"
gem "c", "~> 1.0"
For example, if a Gemfile refers the gem a that depends on the gem b, Envandle also tries to resolve the b's reference by the environment variables.
ENV["ENVANDLE_GEM_PATH"] = "a:/path/to/a;b:/path/to/b"
binding.envandle do
source "https://rubygems.org"
gem "a", "~> 1.0"
end
is evaluated as:
gem "a", path: "/path/to/a"
gem "b", path: "/path/to/b"
The install-envandle command just installs Envandle itself with the bundle install
command. It's useful for successfully loading Envandle in your Gemfile with the Bundler's --path option.
$ install-envandle -h
install-envandle [OPTIONS]
Installs Envandle using Bundler.
Options:
--envandle-source gem source (default: https://rubygems.org)
--envandle-bundle-bin command path (default: bundle)
Additionally, you can specify all of the bundle-install's options.
$ gem install bundler
$ gem install envandle
$ install-envandle --path vendor/bundle
$ bundle install
FAQs
Unknown package
We found that envandle demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
A clarification on our recent research investigating 60 malicious Ruby gems.
Security News
ESLint now supports parallel linting with a new --concurrency flag, delivering major speed gains and closing a 10-year-old feature request.
Research
/Security News
A malicious Go module posing as an SSH brute forcer exfiltrates stolen credentials to a Telegram bot controlled by a Russian-speaking threat actor.