Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Piedesaint is a minimal web server designed to expose directly files and directories (in [TAR](http://en.wikipedia.org/wiki/Tar_(computing) format for convenience) via HTTP or HTTPS.
It was born out of the need of having the simplest web server possible (while still being reasonably fast and secure) to provide files and directories to be used by remote_file Chef resources, solving the issue of distributing packages that for different reasons might not be public or require some interaction to get downloaded, without requiring the installation of a full fledged web server.
It also serves directories (packaging them on the fly) as a single TAR resource.
This is useful in the case of using chef-zero (combined with Vagrant or Test Kitchen, for instance) when database backups/internal git repositories/installation packages need to be transported to the client node but adding those packages to our cookbooks is not desired or possible.
You can add this line to your application's Gemfile:
gem 'piedesaint'
And then execute:
$ bundle
Or install it yourself as:
$ gem install piedesaint
After installation you will need to initialize the configuration by executing:
$ sug init [list of folders to serve, in cascade order]
This creates the .piedesaint
folder that you can inspect and configure (it contains a default shortlived and self-signed SSL key/certificate pair and some additional configuration in YAML format).
By default the configuration will serve the current directory, unless a list of folders is specified. If you want to serve a different folder or set of folders, just edit the configuration.
Host can be set via:
$ sug set_host [host IP]
This is useful/required so that the certificate is created with the correct IP and systems can validate it correctly.
After this, whenever you want to serve the files/directories, just execute:
$ sug
Alternatively, by editing .piedesaint/config
, you can disable compressed folders (:tar: false
), the need for Basic Authorization credentials (using an empty :username:
) or the SSL behaviour (using an empty :key:
).
MIT
If you want to contribute:
git checkout -b my-new-feature
).git commit -am 'Add some feature'
).git push origin my-new-feature
).FAQs
Unknown package
We found that piedesaint demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.