Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Mortise is a Ruby client for the Tenon.io accessibility checker. It lets you easily check for accessibility issues on web pages.
Add this line to your application's Gemfile:
gem 'mortise'
And then execute:
$ bundle
Or install it yourself as:
$ gem install mortise
You'll need an API Key to use Tenon.io, so first register and come back when you've got your API Key.
To check accessibility on a web page, just pass Mortise the URL to check and the API key, like this:
checker = Mortise.check('http://validationhell.com', 'YOUR-API-KEY')
Then, you can check the JSON response like this:
checker.raw # {
# "resultSet":[
# {
# "bpID":1,
# "certainty":100,
# "errorDescription":"All images must have an alt attribute...
Every issue returned will also accessible in a more friendly way like this, where the snake_cased Ruby attributes correspond to the camelCased JSON attributes:
issue = checker.issues.first
issue.bp_id
issue.certainty
issue.error_description
issue.error_snippet
issue.error_title
issue.position
issue.priority
issue.result_title
issue.signature
issue.standards
issue.t_id
issue.xpath
The issues
array contains all issues returned by the checker, but you'll typically be more interested in errors
(that contains all issues with certainty >= 80) and warnings
(that contains all issues with certainty < 80).
By default, Mortise will query the Tenon.io API at http://tenon.io/api/ but if you're using your own Tenon Enterprise instance you can set its location like this:
Mortise.check('http://example.com', 'YOUR-API-KEY', tenon_uri: 'http://yourchecker.com')
By default, Mortise will pass its own identifier on the appID
parameter, so that Tenon can keep usage stats for Mortise.
If you want to use a different value, you can override it like this:
Mortise.check('http://example.com', 'YOUR-API-KEY', tenon_app_id: 'your-app-id')
After checking out the repo, run bundle
to install dependencies. Then, run bundle console
for an interactive prompt that will allow you to experiment.
git checkout -b my-new-feature
)git commit -am 'Add some feature'
)git push origin my-new-feature
)FAQs
Unknown package
We found that mortise demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.