birdcage
cli
birdcage | cli | |
---|---|---|
13 | 72 | |
174 | 8,088 | |
1.1% | 1.1% | |
7.3 | 9.7 | |
about 2 months ago | 6 days ago | |
Rust | JavaScript | |
GNU General Public License v3.0 only | GNU General Public License v3.0 or later |
Stars - the number of stars that a project has on GitHub. Growth - month over month growth in stars.
Activity is a relative number indicating how actively a project is being developed. Recent commits have higher weight than older ones.
For example, an activity of 9.0 indicates that a project is amongst the top 10% of the most actively developed projects that we are tracking.
birdcage
-
Ledger's NPM account has been hacked
Co-funder @ Phylum here (https://phylum.io) We have been actively scanning dependencies across npm (and PyPI, RubyGems, Crates.io, etc.) for nearly three years now; quite successfully, I might add (https://blog.phylum.io/tag/research/). We _automatically_ hit on this package when it was published, and our research team has been all over it.
A collective of us are active in Discord (https://discord.gg/Fe6pr5eW6p), continuing to hunt attacks like these. If that's something that interests you, we'd love to have you!
In addition to this, we've released several open source tools to help protect against supply chain attacks:
1. https://github.com/phylum-dev/birdcage - Birdcage is a cross-platform embeddable sandbox that's been baked into our CLI (which wraps npm, pypi, etc.) to sandbox package installations
2. https://github.com/phylum-dev/cli - Our CLI provides an extension capability so you can lock down random executables you might use during your software development (define _what_ it's allowed to do, e.g. network access, and then lock it down with Birdcage)
We also have a variety of integrations, including Github, Gitlab, BitBucket, CircleCI, Tines, Sophos, etc.
https://docs.phylum.io/docs/integrations_overview
It's unfortunate that software dependency attacks continue to plague open source registries. It seems unlikely this will let up in the near future. We are continuing to work closely with the open source ecosystems to try and get these sorts of packages removed when they pop up.
-
Cryptocurrency Miner Masquerading as GCC Compiler Found in NPM Package
To be clear, this particular package did not execute code during install, so the sandbox wouldn't have come into play, but it would have been blocked by the pre-check against Phylum's API.
Would greatly appreciate any feedback on our extensions and suggestions for improving our sandbox! We recently had a few individuals submit some great issues and suggestions, which we absolutely loved receiving.
Happy to answer any questions about software supply chain attacks or security in general!
1. https://blog.phylum.io/junes-sophisticated-npm-attack-attrib...
2. https://blog.phylum.io/rust-malware-staged-on-crates-io/
3. https://blog.phylum.io/npm-emails-validator-package-malware/
4. https://github.com/phylum-dev/cli
5. https://github.com/phylum-dev/birdcage
-
Rust Malware Staged on Crates.io
We're actively working on this with our sandbox (https://github.com/phylum-dev/birdcage). We've wrapped the likes of pip, yarn, and npm already and are making moves to similarly provide support for cargo.
Currently comes as part of the Phylum CLI (https://github.com/phylum-dev/cli), so that doing something like:
phylum npm install
-
Social engineering campaign targeting tech employees spreads through NPM malware
We (https://phylum.io) actually open sourced our sandbox for this exact purpose.
https://github.com/phylum-dev/birdcage
It's baked into our CLI and supports limiting access to network, disk, etc. during package installation. For example, running something like
phylum npm install react
-
Attackers Repurposing existing Python-based Malware for Distribution on NPM
We've open sourced our sandbox, which limits access to network/disk/etc. during package installation. In this way, nasty install scripts won't have the opportunity to ship your credentials/SSH keys off to a remote sever.
-
Attackers are hiding malware in minified packages distributed to NPM
The sandbox is also open source and available for use by the community.
-
Active Malware Campaign Targeting Popular Python Packages Underway
In addition to this, taking precautions to not install unknown packages is probably also extremely prudent. Towards that end, we've open sourced a cross platform embeddable sandbox for package installations. Source is freely available on Github (https://github.com/phylum-dev/birdcage) and we've added it into our tooling so you can run pip install ... and it'll limit access to disk, network, etc. during package installation.
-
Supply Chain Attack Using PyPI Packages “Colorslib”, “Httpslib”, and “Libhttps”
Been working on this exact thing for nearly two years at https://www.phylum.io. We identified and reported about 1.2k packages in ecosystems like npm, pypi and others last year. GitHub app that checks your PRs for malware. We also built a free open source sandbox for package installations [1] so if malware does get executed it’s done in a locked down environment. Happy to chat further about this sort of thing, it’s something I’m wildly interested in!
[1] https://github.com/phylum-dev/birdcage
- Ransomware currently being published to PyPI in ongoing campaign
-
Ransomware Python Packages Currently Being Published to PyPI
(Disclaimer: I'm one of the co-founders at Phylum)
Our system has been alerting us to this actor's activities all morning (beginning sometime last night). They have been wildly active, and have continued to publish packages as we've worked to get them removed.
Interestingly, they have ported the Python bits to Javascript and have started publishing to NPM as well. Exact same TTP, crossing two ecosystems.
Our platform monitors these ecosystems, scanning packages for signs of risk as they are published. This way we can get them removed before they impact the wider open source community. We currently support Javascript, Typescript, Python, Ruby, Java, C# and recently just rolled out Golang and Rust support into beta.
We believe in a defense in depth approach to supply chain security and have also published an open source sandbox that limits access to the filesystem, network, disk and environment variables.
https://github.com/phylum-dev/birdcage
This is rolled into our CLI so that you can do things like `phylum npm install ` and install packages in a sandboxed way.
Happy to answer questions about this attack, security, sandboxes, etc!
cli
-
'everything' blocks devs from removing their own NPM packages
Because sometimes I make idiotic mistakes and I really don't want that embarrassing stuff out there where people can see. I ran head first into an npm bug once when I tried to symlink the README file which resulted in the thing getting published without a README.
https://github.com/npm/cli/issues/6746
Embarrassing. And then they slapped me with a stupid 24 hour count down on top of it. I seriously hate this thing.
-
Ledger's NPM account has been hacked
This is the same NPM that made a change causing the `integrity` field to go silently missing from `package-lock.json` [0] when installing packages, and then also not complaining at any other time in the future.
[0] https://github.com/npm/cli/issues/4460
-
What's New in Node.js 21
Node.js v21 includes npm v10.2.0, which notably introduces a new sbom command that allows you to generate a Software Bill of Materials (SBOM) for the current project. You can read more about the changes in recent NPM releases on GitHub.
-
Gatsby instalación con problemas recurrentes al conflictuar con cersión de NPM (aparentemente)
npm ERR! This is an error with npm itself. Please report this error at: npm ERR! https://github.com/npm/cli/issues
- Unable to connect to the NPM Registry
-
Quick full-stack app deployment using AWS and Ember.js
You'll need an AWS account and AWS credentials configured locally. We'll use pnpm but you could also use npm or yarn. The finished app is available on github.
-
Building and Launching a Serverless GraphQL React Application with AWS Amplify: A Step-by-Step Guide
~/Documents/amplify-hackathon/amplify-react-graphql-demo main !5 ?3 npm install -g @aws-amplify/cli 1 ✘ 4s 22:11:35 changed 26 packages in 25s 7 packages are looking for funding run `npm fund` for details npm notice npm notice New minor version of npm available! 9.4.0 -> 9.6.5 npm notice Changelog: https://github.com/npm/cli/releases/tag/v9.6.5 npm notice Run npm install -g [email protected] to update! npm notice
-
Multi stage docker build failing due to some error in bcrypt, how to fix it?
10 18.95 npm notice Changelog: https://github.com/npm/cli/releases/tag/v9.6.4
-
Question about CS2s demo viewer and movie features/capabilities
npm WARN deprecated [email protected]: See https://github.com/lydell/source-map-resolve#deprecated npm WARN deprecated [email protected]: This SVGO version is no longer supported. Upgrade to v2.x.x. added 1692 packages, and audited 1699 packages in 23s 211 packages are looking for funding run `npm fund` for details 27 vulnerabilities (1 low, 7 moderate, 18 high, 1 critical) To address issues that do not require attention, run: npm audit fix To address all issues (including breaking changes), run: npm audit fix --force Run `npm audit` for details. npm notice npm notice New minor version of npm available! 9.5.1 -> 9.6.2 npm notice Changelog: https://github.com/npm/cli/releases/tag/v9.6.2 npm notice Run npm install -g [email protected] to update! npm notice
- Everything about package.json
What are some alternatives?
secimport - eBPF Python runtime sandbox with seccomp (Blocks RCE).
gluetun - VPN client in a thin Docker container for multiple VPN providers, written in Go, and using OpenVPN or Wireguard, DNS over TLS, with a few proxy servers built-in.
packj - Packj stops :zap: Solarwinds-, ESLint-, and PyTorch-like attacks by flagging malicious/vulnerable open-source dependencies ("weak links") in your software supply-chain
octo.nvim - Edit and review GitHub issues and pull requests from the comfort of your favorite editor
conf - Simple config handling for your app or module
nvm for Windows - A node.js version management utility for Windows. Ironically written in Go.
wapm-cli - 📦 WebAssembly Package Manager (CLI)
yarn.build - Build 🛠 and Bundle 📦 your local workspaces. Like Bazel, Buck, Pants and Please but for Yarn Berry. Build any language, mix javascript, typescript, golang and more in one polyglot repo. Ship your bundles to AWS Lambda, Docker, or any nodejs runtime.
lunasec - LunaSec - Dependency Security Scanner that automatically notifies you about vulnerabilities like Log4Shell or node-ipc in your Pull Requests and Builds. Protect yourself in 30 seconds with the LunaTrace GitHub App: https://github.com/marketplace/lunatrace-by-lunasec/
vscode-dev-containers - NOTE: Most of the contents of this repository have been migrated to the new devcontainers GitHub org (https://github.com/devcontainers). See https://github.com/devcontainers/template-starter and https://github.com/devcontainers/feature-starter for information on creating your own!
Contents - Community documentation, code, links to third-party resources, ... See the issues and pull requests for pending content. Contributions are welcome !
enquirer - Stylish, intuitive and user-friendly prompts, for Node.js. Used by eslint, webpack, yarn, pm2, pnpm, RedwoodJS, FactorJS, salesforce, Cypress, Google Lighthouse, Generate, tencent cloudbase, lint-staged, gluegun, hygen, hardhat, AWS Amplify, GitHub Actions Toolkit, @airbnb/nimbus, and many others! Please follow Enquirer's author: https://github.com/jonschlinkert