
Research
Two Malicious Rust Crates Impersonate Popular Logger to Steal Wallet Keys
Socket uncovers malicious Rust crates impersonating fast_log to steal Solana and Ethereum wallet keys from source code.
Makes working on the Invoca gems used by applications easier.
Watch it here and count how many times I say "uuum"! (Answer: lots)
The normal workflow would go something like this....
Start in the repo for the application that needs the changes. (For example web or pnapi). Create a branch for your story changes.
I am using invoca-metrics in this example.
bundle exec invoca_gem edit invoca-metrics
This will do the following:
At this point you can edit the invoca-metrics gem from the invoca_gems/invoca_metrics directory. You can confirm your changes work on the app-repo by running tests there.
When ready, save your changes to the invoca_metrics gem.
bundle exec invoca_gem save invoca-metrics --commit-message 'made some changes'
This can take a little while, so brace for it. This will do the following:
Whew.
When ready you can view the changes and issue pull requests from github using the following command.
bundle exec invoca_gem show_changes
This will open a browser window showing all of the changed gems. From there you can open pull requests and confirm build results.
Run the following to find available commands.
bundle exec invoca_gem
Add this line to your application's Gemfile as a development dependency:
group :development do
gem 'invoca_gems'
end
And then execute:
$ bundle
FAQs
Unknown package
We found that invoca_gems demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Socket uncovers malicious Rust crates impersonating fast_log to steal Solana and Ethereum wallet keys from source code.
Research
A malicious package uses a QR code as steganography in an innovative technique.
Research
/Security News
Socket identified 80 fake candidates targeting engineering roles, including suspected North Korean operators, exposing the new reality of hiring as a security function.