
Security News
Follow-up and Clarification on Recent Malicious Ruby Gems Campaign
A clarification on our recent research investigating 60 malicious Ruby gems.
GemMetadata is a Ruby library that allows to filter and access gems by custom metadata keys that their specifications contain.
This project tries to conform to:
Additional facts:
On *nix systems you may need to prefix the command with sudo
to get root
privileges.
gem install gem_metadata
Go into the root directory of the installed gem and run the following command to fetch all development dependencies:
bundle
Afterwards start the test runner:
rake test
If something goes wrong you should be notified through failing examples.
This documentation defines the public interface of the software. The version number of the software tracks changes to this public interface as described in Semantic Versioning. Do not use elements that are marked as private. These elements are not guaranteed to exist in otherwise compatible future versions. Should you really need some parts that are currently marked as private, please contact us. We might be able to expose them as public interface for your convenience.
This is still experimental software, even the public interface may change substantially in future releases.
In most cases you want to load the code by using the following command:
require 'gem_metadata'
In a bundler Gemfile you should use the following:
gem 'gem_metadata'
This project is contained within a namespace to avoid name collisions with other code. If you do not want to specifiy the namespace explicitly you can include it into the current scope by executing the following statement:
include GodObject::GemMetadata
Please use the issue tracker on github.com to let me know about errors or ideas for improvement of this software.
This software is developed in the source code management system Git. There are several synchronized mirror repositories available:
GitHub (located in California, USA)
GitLab (located in Illinois, USA)
BitBucket (located in California, USA)
Pikacode (located in France)
You can get the latest source code with the following command, while exchanging the placeholder for one of the mirror URIs:
git clone MIRROR_URI
The final commit before each released gem version will be marked by a tag named like the version with a prefixed lower-case "v". Every tag will be signed by Alexander E. Fischer's OpenPGP public key which enables you to verify your copy of the code cryptographically.
Add the key to your GnuPG keyring by the following command:
gpg --import aef-openpgp.asc
This command will tell you if your code is of integrity and authentic:
git tag --verify [TAG NAME]
To package your state of the source code into a gem package use the following command:
rake build
The gem will be generated according to the .gemspec file in the project root directory and will be placed into the pkg/ directory.
Help on making this software better is always very appreciated. If you want your changes to be included in the official release, please clone the project on github.com, create a named branch to commit, push your changes into it and send a pull request afterwards.
Please make sure to write tests for your changes so that no one else will break them when changing other things. Also notice that an inclusion of your changes cannot be guaranteed before reviewing them.
The following people were involved in development:
Copyright Alexander E. Fischer aef@godobject.net, 2016
This file is part of GemMetadata.
Permission to use, copy, modify, and/or distribute this software for any purpose with or without fee is hereby granted, provided that the above copyright notice and this permission notice appear in all copies.
THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
FAQs
Unknown package
We found that gem_metadata demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
A clarification on our recent research investigating 60 malicious Ruby gems.
Security News
ESLint now supports parallel linting with a new --concurrency flag, delivering major speed gains and closing a 10-year-old feature request.
Research
/Security News
A malicious Go module posing as an SSH brute forcer exfiltrates stolen credentials to a Telegram bot controlled by a Russian-speaking threat actor.