Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Integration library for gem fog and Backblaze B2 Cloud Storage
Add this line to your application's Gemfile:
gem 'fog-backblaze'
Or install it with gem:
gem install fog-backblaze
require "fog/backblaze"
connection = Fog::Storage.new(
provider: 'backblaze',
# with one key (more secure)
b2_key_id: 'xxxx',
b2_key_token: 'zzzxxxccc'
# full access to b2 account (less secure)
b2_account_id: '123456',
b2_account_token: 'aaaaabbbbbccccddddeeeeeffffff111112222223333',
# optional, used to make some operations faster
b2_bucket_name: 'app-test',
b2_bucket_id: '6ec42006ec42006ec42',
logger: Logger.new(STDOUT).tap {|l|
l.formatter = proc {|severity, datetime, progname, msg|
"#{severity.to_s[0]} - #{datetime.strftime("%T.%L")}: #{msg}\n"
}
},
token_cache: 'file.txt'
)
See example for more details
Most of internal operations requires bucketId
field, to get right value, fog-backblaze will make API request.
Usually applications use only one bucket and it's id never change (it may change only if we delete bucket and create new one with same name).
We can eliminate this API request by setting b2_bucket_id
attribute.
How to get b2_bucket_id
:
p connection._get_bucket_id(bucket_name)
Each request requires authentication token, it comes from b2_authorize_account
response.
Let's say we want to upload a files, then it will make 4 requests inernally:
b2_authorize_account
- valid for 24 hoursb2_list_buckets
- to get bucket_id value can be optimized with :b2_bucket_id
field (should not change)b2_get_upload_url
- valid for 24 hoursResults of steps 1, 2, 3 can be re-used by saving in TokenCache. It acts as general cachin interface with few predefined implementations:
token_cache: :memory
(default)token_cache: 'file.txt'
token_cache: false
or token_cache: Fog::Backblaze::TokenCache::NullTokenCache.new
FAQs
Unknown package
We found that fog-backblaze demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.