
Research
Malicious npm Package Brand-Squats TanStack to Exfiltrate Environment Variables
A brand-squatted TanStack npm package used postinstall scripts to steal .env files and exfiltrate developer secrets to an attacker-controlled endpoint.
redislike
Advanced tools
#+TITLE: redislike - redis-like list operations for moneta #+LATEX: \pagebreak
Overview
redislike adds backend-independent support for redis-like list operations to
any Moneta datastore.
Supported Operations
Other Supported Operations
Differences from Redis
Installation
#+BEGIN_SRC shell gem install redislike #+END_SRC
Example
#+BEGIN_SRC ruby require 'redislike' datastore = Moneta.new :Memory, expires: true
datastore.lpush 'pending', 'foo' datastore.rpoplpush 'pending', 'active' puts datastore.lrange 'active', 0, -1 #+END_SRC
Returns =['foo']=
Motivation
Redis may be my favourite data store, for a number of reasons that have nothing to do with this gem. It's also not a silver bullet. Like many tools, used in the right context, it excels. Out of its element, it adds complexity and overhead (when compared to using a tool better suited to that problem domain).
Then there's Moneta, a lovely gem that provides a unified API to an impressive range of backends for key/value storage. This allows low-effort integration with whatever data store you already have. The consistency also enables trivial swapping of backends as the evolution of an application guides requirements, without rewriting much of anything.
To achive this consistency, Moneta omits support for backend-specfic features. One of those that I often want is the (B)RPOPLPUSH list operation from Redis. This takes an item from the tail of one list, and puts it at the head of another list.
Rather than depending on a Redis backend for Moneta, and passing these operations through to it, I built redis-like queue operations on top of Moneta. Once those were in place, it seemed reasonable to continue and build the rest.
At this point, some sort of scope began to take shape. The methods were restructured to align with those provided by Redis, and tests were written to guide this process.
TL;DR: I wanted RPOPLPUSH in Moneta, didn't define scope boundaries and accidentally reimplemented (some of) Redis.
What's up with the tests?
Alright, so the tests are a bit unconventional, in the sense that you need a working redis server to actually run the tests for a gem with the stated intent of not requiring a redis server.
These tests that redislike is in fact, redis-like. These work by executing the same instructions against redis, and an in-memory instance of redislike, and asserting that the results should be the same.
License
redislike is available under the [[https://tldrlegal.com/license/mit-license][MIT License]]. See LICENSE.txt for the full
text.
Contributors
FAQs
Unknown package
We found that redislike demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A brand-squatted TanStack npm package used postinstall scripts to steal .env files and exfiltrate developer secrets to an attacker-controlled endpoint.

Research
Compromised SAP CAP npm packages download and execute unverified binaries, creating urgent supply chain risk for affected developers and CI/CD environments.

Company News
Socket has acquired Secure Annex to expand extension security across browsers, IDEs, and AI tools.