Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
At Tendigi, we build applications for a variety of clients, often simultaneously, and those applications usually require server-side infrastructure. We also build random things internally from time to time, and these often depend on services that have to live somewhere.
For production deployments, we love Heroku (when it makes financial sense) as well as systems like Deis which can be deployed on AWS / DigitalOcean / etc.
We longed for a simple, on-site PaaS solution that we could hack on as our needs evolved. Dokku is a great project, but we ran into some issues with it (problems updating to newer versions, discrepancies in application behavior compared to our other Deis deployments, a little annoying to work on because it's a collection of shell scripts, etc). As a result, we built EzPaaS: a mini Heroku clone, built in Ruby, powered by Deis images running on Docker.
Important! To use this CLI utility, you need to have EzPaaS Server deployed somewhere. This can be on your local machine (the CLI will connect to localhost
on port 3000 by default) or a remote server by passing the --server
option.
EzPaaS also requires Ruby 2.2 or newer. It may work with older versions, but they have not been tested.
Install the gem. The easiest way is to install it for all users with sudo
:
$ sudo gem install ezpaas-cli
$ ezpaas apps create
$ ezpaas apps list
$ ezpaas deployments push --app=<app name>
$ ezpaas deployments scale [<process=count>...] --app=<app name>
$ ezpaas deployments destroy --app=<app name>
$ ezpaas apps destroy
Bug reports and pull requests are welcome on GitHub.
The gem is available as open source under the terms of the MIT License.
FAQs
Unknown package
We found that ezpaas-cli demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.