
Security News
Follow-up and Clarification on Recent Malicious Ruby Gems Campaign
A clarification on our recent research investigating 60 malicious Ruby gems.
Ruby gems are great. The community of developers is nice. Contributions are welcome and efforts well-received.
With gemrepublica it becomes even easier to clone the code of a given gem and start hacking.
Install with:
$ gem install gemrepublica
Currently, gemrepublica ships with a single executable,
gemrepublica
While gemrepublica --help
will give you a basic help, you usually want to call it like
$ gemrepublica
This will clone the gems source (if it can be found) to the given location.
For example
$ gemrepublica gemrepublica /home/fwolfst/dollies/
will create a git clone of this repository in /home/fwolfst/dollies/gemrepublica
. It's as easy as that!
You want to get coding in zero seconds.
Currently, gemrepublica
only works if the source code link is specified by the maintainer on the rubygems.org homepage and if it points to a github repository.
Currently, gemrepublica
will only clone the HEAD of that github repository.
Unfortunately, the source code link on rubygems.org has to be specified via its interface. I proposed including it in the Gem-Specification, where I hope it will end one day - probably in the 'metadata' (see https://github.com/rubygems/rubygems/issues/1007).
I also proposed to consume this metadata key on the rubygems.org homepage (see https://github.com/rubygems/rubygems.org/issues/718).
We are the people and own code! And create replica of gems easily.
git checkout -b my-new-feature
)git commit -am 'Add some feature'
)git push origin my-new-feature
)FAQs
Unknown package
We found that gemrepublica demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
A clarification on our recent research investigating 60 malicious Ruby gems.
Security News
ESLint now supports parallel linting with a new --concurrency flag, delivering major speed gains and closing a 10-year-old feature request.
Research
/Security News
A malicious Go module posing as an SSH brute forcer exfiltrates stolen credentials to a Telegram bot controlled by a Russian-speaking threat actor.