Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Curb (probably CUrl-RuBy or something) provides Ruby-language bindings for the libcurl(3), a fully-featured client-side URL transfer library. cURL and libcurl live at http://curl.haxx.se/ .
Curb is a work-in-progress, and currently only supports libcurl's 'easy' and 'multi' modes.
Curb is copyright (c)2006 Ross Bamford, and released under the terms of the Ruby license. See the LICENSE file for the gory details.
... will usually be as simple as:
$ gem install curb
Or, if you downloaded the archive:
$ rake install
If you have a weird setup, you might need extconf options. In this case, pass them like so:
$ rake install EXTCONF_OPTS='--with-curl-dir=/path/to/libcurl --prefix=/what/ever'
Curb is tested only on GNU/Linux x86 and Mac OSX - YMMV on other platforms. If you do use another platform and experience problems, or if you can expand on the above instructions, please report the issue at http://github.com/taf2/curb/issues
On Ubuntu, the dependencies can be satisfied by installing the following packages:
$ sudo apt-get install libcurl3 libcurl3-gnutls libcurl4-openssl-dev
Curb has fairly extensive RDoc comments in the source. You can build the documentation with:
$ rake doc
Curb provides two classes:
Curl::Easy
- simple API, for day-to-day tasks.Curl::Multi
- more advanced API, for operating on multiple URLs simultaneously.http = Curl.get("http://www.google.com/")
puts http.body_str
http = Curl.post("http://www.google.com/", {:foo => "bar"})
puts http.body_str
http = Curl.get("http://www.google.com/") do|http|
http.headers['Cookie'] = 'foo=1;bar=2'
end
puts http.body_str
c = Curl::Easy.perform("http://www.google.co.uk")
puts c.body_str
Same thing, more manual:
c = Curl::Easy.new("http://www.google.co.uk")
c.perform
puts c.body_str
Curl::Easy.perform("http://www.google.co.uk") do |curl|
curl.headers["User-Agent"] = "myapp-0.0"
curl.verbose = true
end
Same thing, more manual:
c = Curl::Easy.new("http://www.google.co.uk") do |curl|
curl.headers["User-Agent"] = "myapp-0.0"
curl.verbose = true
end
c.perform
c = Curl::Easy.new("http://github.com/")
c.http_auth_types = :basic
c.username = 'foo'
c.password = 'bar'
c.perform
c = Curl::Easy.new("http://github.com/")
c.ssl_verify_peer = false
c.perform
c = Curl::Easy.new("http://www.google.co.uk")
c.on_body { |data| print(data) }
c.on_header { |data| print(data) }
c.perform
c = Curl::Easy.new
["http://www.google.co.uk", "http://www.ruby-lang.org/"].map do |url|
c.url = url
c.perform
c.body_str
end
c = Curl::Easy.http_post("http://my.rails.box/thing/create",
Curl::PostField.content('thing[name]', 'box'),
Curl::PostField.content('thing[type]', 'storage'))
c = Curl::Easy.new("http://my.rails.box/files/upload")
c.multipart_form_post = true
c.http_post(Curl::PostField.file('thing[file]', 'myfile.rb'))
# make multiple GET requests
easy_options = {:follow_location => true}
multi_options = {:pipeline => true}
Curl::Multi.get('url1','url2','url3','url4','url5', easy_options, multi_options) do|easy|
# do something interesting with the easy response
puts easy.last_effective_url
end
# make multiple POST requests
easy_options = {:follow_location => true, :multipart_form_post => true}
multi_options = {:pipeline => true}
url_fields = [
{ :url => 'url1', :post_fields => {'f1' => 'v1'} },
{ :url => 'url2', :post_fields => {'f1' => 'v1'} },
{ :url => 'url3', :post_fields => {'f1' => 'v1'} }
]
Curl::Multi.post(url_fields, easy_options, multi_options) do|easy|
# do something interesting with the easy response
puts easy.last_effective_url
end
responses = {}
requests = ["http://www.google.co.uk/", "http://www.ruby-lang.org/"]
m = Curl::Multi.new
# add a few easy handles
requests.each do |url|
responses[url] = ""
c = Curl::Easy.new(url) do|curl|
curl.follow_location = true
curl.on_body{|data| responses[url] << data; data.size }
curl.on_success {|easy| puts "success, add more easy handles" }
end
m.add(c)
end
m.perform do
puts "idling... can do some work here"
end
requests.each do|url|
puts responses[url]
end
on_success
is called when the response code is 2xxon_redirect
is called when the response code is 3xxon_missing
is called when the response code is 4xxon_failure
is called when the response code is 5xxon_complete
is called in all cases.FAQs
Unknown package
We found that gus-curb demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.