Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
System to help export Intercom.io conversations into Zendesk tickets. The codebase is designed to be adaptable for importing into other systems or even exporting from things other than Intercom.
$ intercom_export --intercom-app-id <APP ID> --intercom-api-key <APP KEY> \
--zendesk-address <DOMAIN>.zendesk.com --zendesk-username <USERNAME> --zendesk-token <TOKEN>
The coordinator
is the heart of the import. This breaks the problem down into several discrete stages.
source
- This is simple an enumerable, currently this is an enumerable of all Intercom conversationssplitter
- This takes an item from the source and splits it into several parts
that make syncying
easier. For instance an Intecom conversation will be split into all of the users involved in the
conversation, and the conversation itself with the users replaced by references.finder
- This takes a part (something in the land of Intercom), and tries to find it's equivalent in
Zendeskdiffer
- This compares the Intercom part, with the search result from Zendesk and then creates commands.executor
- This executes each command, replacing references to Intercom items, with ids from Zendesk.The idea of breaking it into these components is to allow other front-ends (Intercom), to be slotted in by only adding a few classes. It should also be possible to slot in other back-ends (Zendesk) with a small amount of modification.
$ rspec
This has worked for us importing around 5000 tickets from Intercom to Zendesk. Performance is slow due to the number of queries required.
FAQs
Unknown package
We found that intercom_export demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.