Research
Security News
Malicious npm Package Targets Solana Developers and Hijacks Funds
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
= MyObfuscate
{}[https://travis-ci.org/mavenlink/my_obfuscate]
You want to develop against real production data, but you don't want to violate your users' privacy. Enter MyObfuscate: standalone Ruby code for the selective rewriting of SQL dumps in order to protect user privacy. It supports MySQL, Postgres, and SQL Server.
= Install
(sudo) gem install my_obfuscate
= Example Usage
Make an obfuscator.rb script:
#!/usr/bin/env ruby require "rubygems" require "my_obfuscate"
obfuscator = MyObfuscate.new({ :people => { :email => { :type => :email, :skip_regexes => [/^[\w._]+@my_company.com$/i] }, :ethnicity => :keep, :crypted_password => { :type => :fixed, :string => "SOME_FIXED_PASSWORD_FOR_EASE_OF_DEBUGGING" }, :salt => { :type => :fixed, :string => "SOME_THING" }, :remember_token => :null, :remember_token_expires_at => :null, :age => { :type => :null, :unless => lambda { |person| person[:email] == "hello@example.com" } }, :photo_file_name => :null, :photo_content_type => :null, :photo_file_size => :null, :photo_updated_at => :null, :postal_code => { :type => :fixed, :string => "94109", :unless => lambda {|person| person[:postal_code] == "12345"} }, :name => :name, :full_address => :address, :bio => { :type => :lorem, :number => 4 }, :relationship_status => { :type => :fixed, :one_of => ["Single", "Divorced", "Married", "Engaged", "In a Relationship"] }, :has_children => { :type => :integer, :between => 0..1 }, },
:invites => :truncate,
:invite_requests => :truncate,
:tags => :keep,
:relationships => {
:account_id => :keep,
:code => { :type => :string, :length => 8, :chars => MyObfuscate::USERNAME_CHARS }
}
}) obfuscator.fail_on_unspecified_columns = true # if you want it to require every column in the table to be in the above definition obfuscator.globally_kept_columns = %w[id created_at updated_at] # if you set fail_on_unspecified_columns, you may want this as well obfuscator.obfuscate(STDIN, STDOUT)
And to get an obfuscated dump:
mysqldump -c --add-drop-table --hex-blob -u user -ppassword database | ruby obfuscator.rb > obfuscated_dump.sql
Note that the -c option on mysqldump is required to use my_obfuscator. Additionally, the default behavior of mysqldump is to output special characters. This may cause trouble, so you can request hex-encoded blob content with --hex-blob. If you get MySQL errors due to very long lines, try some combination of --max_allowed_packet=128M, --single-transaction, --skip-extended-insert, and --quick.
== Database Server
By default the database type is assumed to be MySQL, but you can use the builtin SQL Server support by specifying:
obfuscator.database_type = :sql_server
obfuscator.database_type = :postgres
If using Postgres, use pg_dump to get a dump:
pg_dump database | ruby obfuscator.rb > obfuscated_dump.sql
== Types
Available types include: email, string, lorem, name, first_name, last_name, address, street_address, city, state, zip_code, phone, company, ipv4, ipv6, url, integer, fixed, null, and keep.
== Changes
== Note on Patches/Pull Requests
== Thanks
Thanks to Honk for the original gem, Iteration Labs for prior maintenance work, and Pivotal Labs for patches and updates!
== LICENSE
This work is provided under the MIT License. See the included LICENSE file.
The included English word frequency list used for generating random text is provided under the Creative Commons – Attribution / ShareAlike 3.0 license by http://invokeit.wordpress.com/frequency-word-lists/
FAQs
Unknown package
We found that my_obfuscate demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 6 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
Security News
Research
Socket researchers have discovered malicious npm packages targeting crypto developers, stealing credentials and wallet data using spyware delivered through typosquats of popular cryptographic libraries.
Security News
Socket's package search now displays weekly downloads for npm packages, helping developers quickly assess popularity and make more informed decisions.