
Security News
/Research
Wallet-Draining npm Package Impersonates Nodemailer to Hijack Crypto Transactions
Malicious npm package impersonates Nodemailer and drains wallets by hijacking crypto transactions across multiple blockchains.
This library wraps Typhoeus
and Typhoeus::Hydra
and exposes an easy-to-use DSL for quickly building libraries to interact with HTTP resources. Every method you write will automatically export serial (blocking) and parallel (non-blocking) methods, so you can easily parallelize your HTTP code when possible.
monster_mash has a Sinatra-like syntax, and lets you build client API methods using the 4 HTTP verbs:
get(method_name, &definition_block)
post(method_name, &definition_block)
put(method_name, &definition_block)
delete(method_name, &definition_block)
Within each definition_block
, you can set various Typhoeus options.
uri
(required) - the URI to hithandler
(required) - a block to handle an HTTP responseparams
- hash of URI paramsbody
- post bodyheaders
- hash of HTTP headers to sendtimeout
- how long to timeoutcache_timeout
- how long to keep HTTP calls cacheduser_agent
- a User-Agent string to sendmax_redirects
- max number of redirects to followdisable_ssl_peer_verification
- whether to disable SSL verificationclass GoogleJson < MonsterMash::Base
VERSION = '1.0'
# Creates a method called +search+ that takes
# a single +query+ parameter.
get(:search) do |query|
uri "http://ajax.googleapis.com/ajax/services/search/web"
params 'v' => VERSION,
'q' => query,
'rsz' => 'large'
handler do |response|
json = JSON.parse(response.body)
# returns results
json['responseData']['results']
end
end
end
To make serial (blocking) calls using this code, you would then call the class method:
# blocks
results = GoogleJson.search("my search query")
results.each do |result|
puts result['unescapedUrl']
# do other stuff with the response
end
The search(query)
method returns whatever your handler
block returns.
To make parallel (non-blocking) calls, you need an instance of Typhoeus::Hydra:
hydra = Typhoeus::Hydra.new
google = GoogleJson.new(hydra)
10.times do
google.search("my query") do |results, error|
if error
# handle error
else
results.each do |result|
puts result['unescapedUrl']
end
end
end
end
# blocks until all 10 queries complete.
hydra.run
monster_mash will correctly delegate method calls from your handler block to your API class. Example:
class GoogleJson < MonsterMash::Base
VERSION = '1.0'
# Creates a method called +search+ that takes
# a single +query+ parameter.
get(:search) do |query|
uri "http://ajax.googleapis.com/ajax/services/search/web"
params 'v' => VERSION,
'q' => query,
'rsz' => 'large'
handler do |response|
json = JSON.parse(response.body)
# Calls the correct method on GoogleJson.
parse_results(json)
end
end
def self.parse_results(json)
json['responseData']['results']
end
end
If you have Typhoeus settings you want to happen for every request, you can set them in a defaults block:
class GoogleJson < MonsterMash::Base
defaults do
user_agent "GoogleJson Ruby Library"
disable_ssl_peer_verification true
end
# ...
end
If all of your requests share a common base URI, you can set that in your defaults block:
class GoogleJson < MonsterMash::Base
defaults do
base_uri "http://google.com"
end
get(:search) do
uri "/search" # expands to http://google.com/search
end
post(:authenticate) do
uri "https://auth.google.com" # ignores the base_uri
end
end
As well, if you set params
or headers
in the defaults
block, any params
or headers
added later will be merge
d into the hash.
class GoogleJson < MonsterMash::Base
defaults do
params 'api_key' => 'fdas'
end
# The full params hash will look like:
# :q => +query+,
# :v => '1.0',
# :api_key => 'fdas'
get(:search) do |query|
params 'q' => query,
'v' => '1.0'
uri "..."
handler do |response|
# ...
end
end
end
rescue
said error.handler
's run. You need to check for the error in your block and handle it there.Copyright (c) 2010 David Balatero. See LICENSE for details.
FAQs
Unknown package
We found that monster_mash demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
/Research
Malicious npm package impersonates Nodemailer and drains wallets by hijacking crypto transactions across multiple blockchains.
Security News
This episode explores the hard problem of reachability analysis, from static analysis limits to handling dynamic languages and massive dependency trees.
Security News
/Research
Malicious Nx npm versions stole secrets and wallet info using AI CLI tools; Socket’s AI scanner detected the supply chain attack and flagged the malware.