Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Due to the new mandatory change regarding the new Tokenization of the API we launch the version 1.1, now aside from the default parameters, we will have to request your token via boarding process and then use it with the API, details regarding the api usage, were updated, but if you want to know more about the tokenization, check the FAQ.
Due to the case-2022-05-05-1450
opened by the CSIRT team we had to migrate from the Public Github to the Github Enterprise, this change forced us to change the name of the gem.
Since the ruby does require the name of the gem to be used as the name of the class. Check below what changed:
Change the name of the gem to the new one in your Gemfile file and hit bundle install
on your terminal.
# From
gem 'rails_ibm-uprofile', '~> 0.3.2', require: 'rails_ibm/uprofile'
# To
gem 'ibm_tools-people', '~> 1.0.0', require: 'ibm_tools/people'
Change everywhere you have within your application from the old class name to the new one.
# From
RailsIbm::Uprofile.info
# To
IbmTools::People.info
From now on it should be transparent and require no other action.
Welcome to your Rais IBM Tools module! This gem intend to provide you some fetures used on IBM Web applications *.
* IBM VPN is required
Fetch data from the user based on search params.
Feature to come.
Everyone interacting in the IbmTools::People project's codebases, issue trackers, chat rooms and mailing lists is expected to follow the code of conduct.
Add this line to your application's Gemfile:
gem 'ibm_tools-people'
And then execute:
$ bundle install
Or install it yourself as:
$ gem install ibm_tools-people
This module allow you to fetch information from Profile directory (using the Unified-profile).
This module have different methods to search the users and provide different data:
This module allos you to search one or more entries at time, it will return the information about the employee(s)
require 'ibm_tools/people'
IbmTools::People.info(uid: '000000000')
Since there are different kind of ways to search the user and to ensure readability we split it in several alternatives. It is important to know that at least one of these args are required.
name | value | Usage |
---|---|---|
uid | String | IbmTools::People.info(uid: '000000000') |
uids | Array | IbmTools::People.info(uids: ['000000000', '111111111']) |
String | IbmTools::People.info(email: 'johndoe@ibm.com') | |
emails | Array | IbmTools::People.info(emails: ['johndoe@ibm.com', 'janedoe@ibm.com']) |
query | String | IbmTools::People.info(query: 'John Doe') |
token | String | token: nbvcsw23456yhbvfrt6789olkmnhyu8i9olkmnhgtrdf * |
Token can be used as a argument of the module, but it will also look for the environment variable
IBM_PEOPLE_API_KEY
optional
)Attribure | Type | Default | Purpose |
---|---|---|---|
parsed | Boolean | true | Returns a Parsed Object if false Return a PeopleUnifiedProfileAPI Object |
remap | Boolean | false | Returns a Remapped Object. This option is ignored if parsed is true |
serial | String | '000000' | Will increase the performance of the search by fetching first entries that are peers from the serial informed. Only available for query arg. |
limit | Number | 10 | Will limit the result of the API in the number specified. Only available for query arg. |
start | Number | 0 | Will start from this position of the list (common used for pagination). Only available for query arg. |
array | Boolean | true | The result will be an array instead of an object. Only available for query arg. This option is ignored if detailed is false. |
These are the following models available in this API.
{
:"uid_#{query}": PeopleUnifiedProfileAPI.content
}
# Ex.:
# $ IbmTools::People.info(uid: '000000000')
# $ => { uid_000000000: PeopleUnifiedProfileAPI.content }
{
:"#{query}": PeopleUnifiedProfileAPI.content
}
# Ex.:
# $ IbmTools::People.info(email: 'johndoe@ibm.com')
# $ => { johndoe@ibm.com: PeopleUnifiedProfileAPI.content }
It will rewrite the object to a DefaultTemplate used by this module (preferred for authentications)
{
uid: PeopleUnifiedProfileAPI.content.uid,
name: PeopleUnifiedProfileAPI.content.nameFull,
email: PeopleUnifiedProfileAPI.content.preferredIdentity,
shortname: PeopleUnifiedProfileAPI.content.nameDisplay || PeopleUnifiedProfileAPI.content.nameFull
}
{
:"uid_#{query}": DefaultTemplate
}
# Ex.:
# $ IbmTools::People.info(uid: '000000000')
# $ => { uid_000000000: ShortDataUserObject }
{
:"#{query}": DefaultTemplate
}
# Ex.:
# $ IbmTools::People.info(email: 'johndoe@ibm.com')
# $ => { johndoe@ibm.com: ShortDataUserObject }
This method only allows one search at time and it will return the skill set information of the employee.
require 'ibm_tools/people'
IbmTools::People.skills(uid: '000000000')
This module have 2 variations, you can check the details below:
Since there are different kind of ways to search the user and to ensure readability we split it in several alternatives. It is important to know that at least one of these args are required.
name | value | Usage |
---|---|---|
uid | String | IbmTools::People.info(uid: '000000000') |
String | IbmTools::People.info(email: 'johndoe@ibm.com') | |
token | String | token: nbvcsw23456yhbvfrt6789olkmnhyu8i9olkmnhgtrdf * |
Token can be used as a argument of the module, but it will also look for the environment variable
IBM_PEOPLE_API_KEY
There are no special remapping or parsing for this results, the schema can be checked on PeopleUnifiedProfileAPI docs
This method only allows one search at time and it will return the peers and hierarchical tree of the employee (Inside and Outside the country)
require 'ibm_tools/people'
IbmTools::People.skills(uid: '000000000')
This module have 2 variations, you can check the details below:
Since there are different kind of ways to search the user and to ensure readability we split it in several alternatives. It is important to know that at least one of these args are required.
name | value | Usage |
---|---|---|
uid | String | IbmTools::People.info(uid: '000000000') |
String | IbmTools::People.info(email: 'johndoe@ibm.com') | |
token | String | token: nbvcsw23456yhbvfrt6789olkmnhyu8i9olkmnhgtrdf * |
Token can be used as a argument of the module, but it will also look for the environment variable
IBM_PEOPLE_API_KEY
There are no special remapping or parsing for this results, the schema can be checked on PeopleUnifiedProfileAPI docs
This method only allows one search at time and it will return the peers and hierarchical tree of the employee (Inside and Outside the country)
require 'ibm_tools/people'
IbmTools::People.skills(uid: '000000000')
This module have 2 variations, you can check the details below:
Since there are different kind of ways to search the user and to ensure readability we split it in several alternatives. It is important to know that at least one of these args are required.
name | value | Usage |
---|---|---|
uid | String | IbmTools::People.info(uid: '000000000') |
String | IbmTools::People.info(email: 'johndoe@ibm.com') | |
token | String | token: nbvcsw23456yhbvfrt6789olkmnhyu8i9olkmnhgtrdf * |
Token can be used as a argument of the module, but it will also look for the environment variable
IBM_PEOPLE_API_KEY
There are no special remapping or parsing for this results, the schema can be checked on PeopleUnifiedProfileAPI docs
I'm in shame to do this, but since I was in a hurry, we got some testers to verify this project, and I know I should implement some automated tests. But this module were created for a project and because of this I had to do this way.
Bug reports and pull requests are welcome on GitHub at https://github.ibm.com/thiagogs/ibm_tools-people. This project is intended to be a safe, welcoming space for collaboration, and contributors are expected to adhere to the code of conduct.
The gem is available as open source under the terms of the MIT License.
FAQs
Unknown package
We found that ibm_tools-people demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.