Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Simple library to get current gcp data like project and region.
Add this line to your application's Gemfile:
gem 'gcp_data'
And then execute:
$ bundle install
Or install it yourself as:
$ gem install gcp_data
This library can rely on the gcloud
command, so it should be installed.
GcpData.project
GcpData.region
This library will return project and region info using different sources with this precedence:
The environment variables take the highest precedence: GOOGLE_PROJECT, GOOGLE_REGION, GOOGLE_ZONE
You can also authenticate to the Google API by setting a GOOGLE_APPLICATION_CREDENTIALS env var that points to file a JSON file on your system. Example: GOOGLE_APPLICATION_CREDENTIALS=~/.gcp/credentials.json
. More info at google docs: Getting Started with Authentication.
This file contains a project_id key. So if you have set the GOOGLE_APPLICATION_CREDENTIALS and not set the GOOGLE_PROJECT var, then this library will use the project_id from the GOOGLE_APPLICATION_CREDENTIALS file.
The gcloud cli can also be used to set and get google project and region info. Here's a cheatsheet of the commands:
gcloud config list
gcloud config set project project-123
gcloud config set compute/region us-central1
gcloud config set compute/zone us-central1-b
The commands saves to a file in ~/.config/gcloud. The file looks something like this:
~/.config/gcloud/configurations/config_default
[core]
project = project-12345
[compute]
region = us-central1
zone = us-central1-a
The library will fall back to default values when it's unable to lookup the region and zone. The default values are:
region=us-central1
zone==us-central1a
Bug reports and pull requests are welcome on GitHub at https://github.com/boltops-tools/gcp_data.
FAQs
Unknown package
We found that gcp_data demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.