Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
The aim of this gem is to create backup of databases from on Heroku and upload it on Amazon S3. The gem is a very simple container of a rake task which can be executed manually or a scheduler can be used.
Initially heroku used to provide a back up add-on which has been now discountinued in favour of the pg backup service (check here). The problem I faced was when we have multiple applications on heroku, the service has to be executed for all the applications. Also there is no automated way of doing this and hence the rake task is created. In this gem, one can specify all the applications the backup is required and the heroku user credentials in the environment variables and if the user has permission to access the app, backup will be taken. Detailed usage is given below:
Add this line to your application's Gemfile:
gem 'heroku_multi_backup'
And then execute:
$ bundle
Or install it yourself as:
$ gem install heroku_multi_backup
To use this gem on heroku, add the environment variables using
heroku config:set somevar=someval
On the local development system , I personally use foreman and use env file to specify the variables. A sample env file:
S3_ACCESS_ID=******
#Access Id for Amazon S3 server
S3_ACCESS_SECRET=****
#Access secret for Amazon S3 server
S3_REGION=****
#Region of your Amazon S3 server
S3_BUCKET=****
#Name of the bucket you want the backup files to be uploaded to
APPNAME=app1,app2,app3
#List of all applications whose backup has to be taken
HEROKU_USERNAME=me@myemail.com
#Username for heroku
HEROKU_API_KEY=*****
#API key for heroku
#NOTE: Username and api key are used for authentication and checking if user has access to all apps listed.
Once this is done run the rake task as:
rake heroku_multi_backup:autobackup
If you are using foreman use:
foreman run rake heroku_multi_backup:autobackup
And voila ! Files will be uploaded to your bucket.
##TODO
git checkout -b my-new-feature
)git commit -am 'Add some feature'
)git push origin my-new-feature
)##References I must accept that the idea for this gem has come using pgbackup-archive gem and I have also used his code as reference.
FAQs
Unknown package
We found that heroku_multi_backup demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.