Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Running this should only require Rails 2.2.2 or later, and the command line interfaces for sqlite3 and curl. Tested on Ubuntu Linux 9.04 ("Jaunty Jackalope") and Mac OSX 10.5.6 ("Leopard").
Installation of all necessary dependencies from a fresh install of Ubuntu 9.04:
sudo apt-get install rails git-core sqlite3 curl sudo gem install rubygems-update sudo /var/lib/gems/1.8/bin/update_rubygems sudo gem install rails sudo gem sources -a http://gems.github.com sudo gem install rubys-gorp
Execution instructions:
This is a library which, among other things, will interpret ARGV. Here's an example based on http://github.com/rubys/awdwr:
ruby makedepot.rb [VERSION] [--bundle] [--restore] [RANGE]... [--save]
"VERSION" - specifies the Rails version to test. Examples:
edge
_2.2.2_
~/git
"--bundle" - bundle this version of rails with each Rails app generated.
- if libraries are listed in the RUBYLIB environment variable, they
will be added as directories to the Gemfile before making the bundle
(adding '--system' will only bundle system gems)
"--restore" - restore from snapshot before resuming execution
"RANGE" - specifies a set of sections to execute. Examples:
6.2..6.5
7.1-9.5
16
"--save" - save snapshot after execution completes
"--rails-debug" - turn on BACKTRACE and Thread.abort_on_exception
Tests against the output produced (e.g., makedepot.html) can also be run separately:
ruby checkdepot.rb [partial]
"partial" means that tests which cover sections that are not included in makedepot.html are to be omitted.
FAQs
Unknown package
We found that gorp demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.