Research
Security News
Malicious npm Package Targets Solana Developers and Hijacks Funds
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
_____
(, / ) , /) /)
/__ / __ _ // _ _ _(/ _ __
) / \__(_/ (_(_/_(/__(/_(_(_(_(__(/_/ (_
(_/ .-/
(_/
Ringleader is an application proxy for socket applications.
Yes.
I designed this for a large suite of apps running behind nginx with a somewhat complex routing configuration. Additionally, many of the apps required active resque pollers to run properly. Ultimately this meant having many terminal windows open just to make a few requests to the apps. Instead, I wanted something to manage all that for me.
Before, each app in a terminal, started manually:
+-------+
+->| app 1 |
| +-------+
+-----------+ |
http | | | +-------+
requests ---> | nginx +--+->| app 2 |
| | | +-------+
+-----------+ |
| +-------+
+->| app n |
+-------+
After, apps managed by ringleader, started on demand:
+-------+
+->| app 1 |
| +-------+
+-----------+ +--------------+ |
http | | | | | +-------+
requests ---> | nginx +--->| ringleader +--+->| app 2 |
| | | | | +-------+
+-----------+ +--------------+ |
| +-------+
+->| app n |
+-------+
Ringleader gives on-demand startup and proxying for any TCP server program. It can be a rails app managed with foreman, a node app, or simply a shell command to start netcat.
Pretty much. But with pretty colors in console and a nice web interface.
Yep. Hook it up with fluid and put it in the menu bar. By default it runs at http://localhost:42000.
$ gem install ringleader
$ ringleader --help
Ringleader requires a yml configuration file to start. It should look something like this:
---
# name of app (used in logging)
main_app:
# Required settings
dir: "~/apps/main" # Working directory
command: "foreman start" # The command to run to start up the app server.
# Executed under "bash -c".
server_port: 3000 # The port ringleader listens on
app_port: 4000 # The port the application listens on
# Optional settings
host: 127.0.0.1 # The host ringleader should listen on
idle_timeout: 6000 # Idle timeout in seconds, 0 for infinite
startup_timeout: 180 # Application startup timeout
disabled: true # Set the app to be disabled when ringleader starts
env: # Override or set environment variables inherited
FOO: hello # from the current environment. Use nil to unset a
BAR: nil # var.
kill_with: INT # Signal to use to kill the process tree with. Use
# TERM or KILL if the default is leaving zombies.
run_on_load: false # Set this to true to start an app when ringleader
# loads.
# If you have an application managed by rvm, this setting automatically adds
# the rvm-specific shell setup before executing the given command. This
# supersedes the `command` setting.
rvm: "foreman start"
# Likewise for rbenv:
rbenv: "foreman start"
# And chruby:
chruby: "foreman start"
other_app:
[...]
MIT, see LICENSE
.
Top hat icon by Luka Taylor under a Creative Commons Attribution/Non-commercial license.
git checkout -b my-new-feature
)git commit -am 'Add some feature'
)git push origin my-new-feature
)FAQs
Unknown package
We found that ringleader demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
Security News
Research
Socket researchers have discovered malicious npm packages targeting crypto developers, stealing credentials and wallet data using spyware delivered through typosquats of popular cryptographic libraries.
Security News
Socket's package search now displays weekly downloads for npm packages, helping developers quickly assess popularity and make more informed decisions.