Research
Security News
Malicious npm Package Targets Solana Developers and Hijacks Funds
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
This Micro Gem encapsulates Express Checkout Paypal API. To experiment with that code, run bin/console
for an interactive prompt. To play with cart object:
require_relative './lib/yukon/cart.rb'
This project is sponsored by Zepho Inc. If you are interested in learning TDD in Ruby, you can redeem the coupon here: https://www.udemy.com/learn-test-driven-development-in-ruby/?couponCode=svr
Ruby : 2.2.2, 2.2.3 or 2.3.0 ActiveMerchant : 1.52
Add this line to your application's Gemfile:
gem 'yukon'
And then execute:
$ bundle
Or install it yourself as:
$ gem install yukon
For a Rails app, create yukon.rb in config/initializers.rb:
paypal_config = Rails.application.config_for(:paypal)
Yukon.configuration do |config|
config.login = paypal_config['login']
config.password = paypal_config['password']
config.signature = paypal_config['signature']
end
Create paypal.yml in config folder and provide the values for the Paypal credentials:
development:
login: your-paypal-sandbox-login-email
password: your-paypal-sandbox-login-password
signature: your-paypal-sandbox-signature
mode: :test
The mode value is :test for development and test environments and :live only for production. For a sample Rails 4.2.4 app using Ruby 2.2.3, check out : https://bitbucket.org/bparanj/paypalexpress. You can also copy the paypal-sample.yml in the config directory of the yukon gem source code.
Credentials Checker
CredentialsChecker.check(login, password, signature)
Wrong login, password or signature results in response.message value:
Security header is not valid.
You can use the above method in your custom rake task to test Paypal credentials.
Credentials Test from the Command Line using Curl
Once you’ve set up your test accounts and have your API test credentials, you’re ready to make PayPal requests to the Sandbox environment.
The following cURL command makes an Express Checkout call to the Sandbox. Execute the request from the command line by replacing the credential values in the command with those from your Sandbox Business account. You should get success in response to the request:
Request:
curl -s --insecure https://api-3t.sandbox.paypal.com/nvp -d "USER=bparan_1360459336_biz_api1.gmail.com&PWD=1360459362&SIGNATURE=AiPC9BjkCyDFQXbSkoZcgqH3hpacARbNPHYwGcAEv3pAorm.KuIxgJw8&METHOD=SetExpressCheckout&VERSION=98&PAYMENTREQUEST_0_AMT=10&PAYMENTREQUEST_0_CURRENCYCODE=USD&PAYMENTREQUEST_0_PAYMENTACTION=SALE&cancelUrl=http://www.example.com/cancel.html&returnUrl=http://www.example.com/success.html"
Response:
TOKEN=EC%2d7E679406DY7307812&TIMESTAMP=2015%2d08%2d16T20%3a54%3a43Z&CORRELATIONID=61233e65728ce&ACK=Success&VERSION=98&BUILD=000000
Use the following sample by replacing with the token from the SetExpressCheckoutPayment response:
curl -s --insecure https://api-3t.sandbox.paypal.com/nvp -d "USER=bparan_1360459336_biz_api1.gmail.com&PWD=1360459362&SIGNATURE=AiPC9BjkCyDFQXbSkoZcgqH3hpacARbNPHYwGcAEv3pAorm.KuIxgJw8&METHOD=GetExpressCheckoutDetails&VERSION=93&TOKEN=<tokenValue>"
The response from this call includes the PayerID value, which is needed to capture the payment:
GetExpressCheckoutDetails response:
TOKEN=EC%2d4RX1920730957200V
...
&PAYERID=6B9DKHQRKW4SG
...
Paypal Test Credentials
test:
username: jb-us-seller_api1.paypal.com
password: WX4WTU3S8MY44S7F
signature: AFcWxV21C7fd0v3bYYYRCpSSRl31A7yDhhsPUU2XhtMoZXsWHFxu-RWy
app_id: APP-80W284485P519543T
http_timeout: 30
mode: sandbox
sandbox_email_address: platform.sdk.seller@gmail.com
After checking out the repo, run bin/setup
to install dependencies. Then, run rspec
to run the tests. You can also run bin/console
for an interactive prompt that will allow you to experiment.
To install this gem onto your local machine, run bundle exec rake install
. To release a new version, update the version number in version.rb
, and then run bundle exec rake release
, which will create a git tag for the version, push git commits and tags, and push the .gem
file to rubygems.org.
Bug reports and pull requests are welcome on GitHub at https://bitbucket.orb/bparanj/yukon.
The gem is available as open source under the terms of the MIT License.
FAQs
Unknown package
We found that yukon demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
Security News
Research
Socket researchers have discovered malicious npm packages targeting crypto developers, stealing credentials and wallet data using spyware delivered through typosquats of popular cryptographic libraries.
Security News
Socket's package search now displays weekly downloads for npm packages, helping developers quickly assess popularity and make more informed decisions.