
Security News
Follow-up and Clarification on Recent Malicious Ruby Gems Campaign
A clarification on our recent research investigating 60 malicious Ruby gems.
The Infochimps Platform is an end-to-end, managed solution for building Big Data applications. It integrates best-of-breed technologies like Hadoop, Storm, Kafka, MongoDB, ElasticSearch, HBase, &c. and provides simple interfaces for accessing these powerful tools.
Computation, analytics, scripting, &c. are all handled by Wukong within the platform. Wukong is an abstract framework for defining computations on data. Wukong processors and flows can run in many different execution contexts including:
The Infochimps Platform uses the concept of a deploy pack for developers to develop all their processors, flows, and jobs within. The deploy pack can be thought of as a container for all the necessary Wukong code and plugins useful in the context of an Infochimps Platform application. It includes the following libraries:
The deploy pack is installed as a RubyGem:
$ sudo gem install wukong-deploy
Wukong-Deploy provides a command-line tool wu-deploy
which can be
used to create or interact with deploy packs.
Create a new deploy pack:
$ wu-deploy new my_app
Within /home/user/my_app:
create .
create app/models
create app/processors
...
This will create a directory my_app
in the current directory.
Passing the dry_run
option will print what should happen without
actually doing anything:
$ wu-deploy new my_app --dry_run
Within /home/user/my_app:
create .
create app/models
create app/processors
...
You'll be prompted if there is a conflict. You can pass the force
option to always overwrite files and the skip
option to never
overwrite files.
If your current directory is within an existing deploy pack you can start up an IRB console with the deploy pack's environment already loaded:
$ wu-deploy console
irb(main):001:0>
A deploy pack is a repository with the following Rails-like file structure:
├── app
│ ├── models
│ ├── processors
│ ├── flows
│ └── jobs
├── config
│ ├── environment.rb
│ ├── application.rb
│ ├── initializers
│ ├── settings.yml
│ └── environments
│ ├── development.yml
│ ├── production.yml
│ └── test.yml
├── data
├── Gemfile
├── Gemfile.lock
├── lib
├── log
├── Rakefile
├── spec
│ ├── spec_helper.rb
│ └── support
└── tmp
Let's look at it piece by piece:
FAQs
Unknown package
We found that wukong-deploy demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 3 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
A clarification on our recent research investigating 60 malicious Ruby gems.
Security News
ESLint now supports parallel linting with a new --concurrency flag, delivering major speed gains and closing a 10-year-old feature request.
Research
/Security News
A malicious Go module posing as an SSH brute forcer exfiltrates stolen credentials to a Telegram bot controlled by a Russian-speaking threat actor.