Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
This is a Gem created to manage the connection of a ruby/rails service
to Guide's GRPC Server (Sidecar). With it you can simplify the connection
process and send data to the sidecar both synchronously and asynchronously.
In order to connect to the grpc server, the app must use the https protocol.
In order to successfully connect to the server through https - instead of having it's connection
refused -, a .crt
security certificate file must be provided.
You can do that by either adding this line to your application's Gemfile:
gem 'grpc_toolbox'
And then executing:
bundle install
Or by installing directly with:
gem install grpc_toolbox
You only need to this step if you're using docker
or docker-compose
to run the application.
As said on the Pre-requisites
section, you'll need a .crt
file that can authenticate your connection
to the grpc server.
This step is to make it so the container can copy the .crt
file provided by the host.
If you're using docker-compose, all you'll need to do is to make sure the volumes
section of your
docker-compose.yaml
has this line:
volumes:
- "${HOST_CERTIFICATES}/:${CONTAINER_CERTIFICATES_FOLDER}/"
Where:
HOST_CERTIFICATES
is the path to the folder on the HOST machine where the .crt file is locatedCONTAINER_CERTIFICATES_FOLDER
is the path to folder on the CONTAINER where the host's files are going to be copied to.Example:
volumes:
- "/home/master/certificates/:/https/"
if you're using docker run
, you'll need to add the following option to your command:
-v {HOST_CERTIFICATES}:{CONTAINER_CERTIFICATES_FOLDER}
Where:
HOST_CERTIFICATES
is the path to the folder on the HOST machine where the .crt file is locatedCONTAINER_CERTIFICATES_FOLDER
is the path to folder on the CONTAINER where the host's files are going to be copied to.Example:
docker run --name your_service -v /home/master/certificates:/https/ your-image
Create a file named grpc_toolbox.rb
inside the config/initializers
, then add the following lines:
GRPCToolbox.configure do |config|
config.server = {GRPC_SERVER_HOST}
config.certificate_path = {CONTAINER_CERTIFICATES_FULLPATH}
end
Where
GRPC_SERVER_HOST
is the address the gem will use to communicate to the grpc_serverCONTAINER_CERTIFICATES_FULLPATH
is the full path to the .crt
file the gem will use, including the file name.
Example:
GRPCToolbox.configure do |config|
config.server = "sidecar:443"
config.certificate_path = "/https/example.crt"
end
Once configured, you'll just need to create an client object:
client = GRPCToolbox::Client.new
then, pass the params you want to send as hash to the function send_audit_request
:
params = {
origin_ip: '127.0.0.1',
username: 'rlnascimento',
origin_type: 'num-sei',
system: 'gem-toolbox',
module: 'gem',
operation_type: 'update'
}
client.async.send_audit_request(params)
You can either use client.async.send_audit_request
or client.send_audit_request
. The logic is
the same, the only difference is that the first one is asynchronous and the second one is not.
FAQs
Unknown package
We found that grpc_toolbox demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.