Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Agile development tool that monitors a directory tree, and triggers a user defined action whenever an observed file is modified. Its most typical use is continuous testing, and as such it is a more flexible alternative to autotest.
watchr is:
Most importantly it allows running tests in an environment that is agnostic to:
On the command line,
$ watchr path/to/script.file
will monitor files in the current directory tree, and react to events on those files in accordance with the script.
The script contains a set of simple rules that map observed files to an action.
Its DSL is a single method: watch(pattern, &action)
watch( 'a regexp pattern matching paths to observe' ) {|match_data_object| command_to_run }
So for example,
watch( 'test/test_.*\.rb' ) {|md| system("ruby #{md[0]}") }
will match any test file and run it whenever it is saved.
A continuous testing script for a basic project could be
watch( 'test/test_.*\.rb' ) {|md| system("ruby #{md[0]}") }
watch( 'lib/(.*)\.rb' ) {|md| system("ruby test/test_#{md[1]}.rb") }
which, in addition to running any saved test file as above, will also run a lib file's associated test. This mimics the equivalent autotest behaviour.
It's easy to see why watchr is so flexible, since the whole command is custom. The above actions could just as easily call "jruby", "ruby --rubygems", "ruby -Ilib", "specrb", "rbx", ... or any combination of these. For the sake of comparison, autotest runs with:
$ /usr/bin/ruby1.8 -I.:lib:test -rubygems -e "%w[test/unit test/test_helper.rb test/test_watchr.rb].each { |f| require f }"
locking the environment into ruby1.8, rubygems and test/unit for all tests.
And remember the scripts are pure ruby, so feel free to add methods,
Signal#trap
calls, etc. Updates to script files are picked up on the fly (no
need to restart watchr) so experimenting is painless.
The wiki has more details and examples. You might also want to take a look at watchr's own scripts, specs.watchr, docs.watchr and gem.watchr, to get you started.
gem install watchr
If you're on Linux/BSD and have the rev gem installed, Watchr will detect it and use it automatically. This will make Watchr evented.
gem install rev
You can get the same evented behaviour on OS X by installing ruby-fsevent.
gem install ruby-fsevent
FAQs
Unknown package
We found that watchr demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.