
Research
Shai-Hulud Descends to Hades: Miasma Worm Campaign Spreads with New PyPI Wave
Socket found 37 malicious PyPI wheels that abuse Python startup hooks to launch a Bun-powered credential stealer tied to Mini Shai-Hulud/Miasma.
refinerycms-s3assets
Advanced tools
A common development scenario, when using a Heroku-hosted Refinery CMS app, is to copy production data to development via the use of heroku db:pull.
This gem adds a rake task to your Refinery CMS project which copies your production assets stored on s3 onto the local filesystem.
Open up your Gemfile and add at the bottom this line:
gem 'refinerycms-s3assets', :group => :development
Now, run:
bundle install
This gem assumes that your production Heroku app is storing assets on Amazon s3
and that your Heroku app has the following three config vars properly defined:
S3_BUCKET, S3_KEY and S3_SECRET ( see http://devcenter.heroku.com/articles/config-vars for more info).
Start by copying your production database to your local database:
heroku db:pull
To copy all Image and Resource files from S3 you can now run the following:
bundle exec rake refinery_s3assets:pull
Start by copying your development database to your production:
heroku db:push
To copy all Image and Resources files from local development to S3 you can run the following:
bundle exec rake refinery_s3assets:push
If you do not have a Heroku application but you do know the S3 credentials then you can provide these manually as ENV variables:
S3_KEY=key S3_SECRET=secret S3_BUCKET=bucket bundle exec rake refinery_s3assets:pull
There is currently no prompting if you are overwriting existing files so please be careful.
Please see MIT-LICENSE for more details.
Copyright (c) 2012 Rounders Consulting Inc.
FAQs
Unknown package
We found that refinerycms-s3assets demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Socket found 37 malicious PyPI wheels that abuse Python startup hooks to launch a Bun-powered credential stealer tied to Mini Shai-Hulud/Miasma.

Security News
RubyGems and Bundler 4.0.13 introduced an opt-in cooldown feature that delays newly published gems during dependency resolution.

Security News
pnpm 11.5 now recognizes npm staged publish approvals in release metadata, preventing those releases from being mistaken for lower-trust package publishes.