Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
gitlab-cloud-connector
Advanced tools
Ruby gem containing shared code for Cloud Connector token issuers (GitLab, CustomersDot).
We expect Bundler is used to manage dependencies. To add the dependency, add it to Gemfile
:
gem "gitlab-cloud-connector", "~> 0.1.1", require: 'cloud_connector'
Cloud Connector uses YAML files stored in the project's /config
directory. The data is organized by model type:
# config/backend_services/ai_gateway.yml
name: ai_gateway
description: "AI Gateway"
jwt_aud: gitlab-ai-gateway
# config/add_ons/duo_pro.yml
name: duo_pro
description: "Duo Pro"
# config/unit_primitives/duo_chat.yml
name: duo_chat
description: "Duo Chat"
backend_services:
- ai_gateway
add_ons:
- duo_pro
- duo_enterprise
DataModels
are the core data structures in the Cloud Connector. Each model inherits from DataModel::Base
. The data is loaded from YAML files into memory at runtime, making it efficient for read operations and relationship traversal.
require 'cloud_connector'
# Find unit primitive by name
# Note: value should be a symbol (e.g., `:duo_chat` instead of `'duo_chat'`).
duo_chat = Gitlab::CloudConnector::DataModels::UnitPrimitive.find_by_name(:duo_chat)
duo_chat.description
duo_chat.cut_off_date
# access associations
duo_chat.add_ons
duo_chat.license_types
duo_chat.backend_services
# read duo_chat audiences
duo_chat.backend_services.map(&:jwt_aud)
See Release Process
Once the new gem version is visible on RubyGems.org,
it is recommended to update GitLab's Gemfile
and Customers Dot's Gemfile
to bump the gitlab-cloud-connector
Ruby gem to the new version also. See Usage for how to do this.
FAQs
Unknown package
We found that gitlab-cloud-connector demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.