Liran Tal lirantal

The following creates a container with a mounted volume so it can be used as a sandbox that doesn't expose your local development environment incase of any rogue npm packages that steal your .npmrc token, environment variables and others

Run the following:

Read all chat messages

curl --request GET --url "http://localhost/chat"

Send a chat message

curl --request PUT \
  --url "http://localhost/chat" \
 --header 'content-type: application/json' \

Command Injection vulnerability in [email protected]

git-clone-or-pull describes itself as a tool to ensure a git repo exists on disk and that it's up-to-date.

Resources:

Project's GitHub source code: https://github.com/feross/git-pull-or-clone
Project's npm package: https://npmjs.org/package/git-pull-or-clone

Background on exploitation

Why the absence of lockfiles doesn't help consumers

you build a library: thewesley
it has no lockfile
it has a prod dep: baby-yoda@~1.0.0
you published [email protected] and tested it works well with [email protected]
it’s Dec 30: you’re on your honeymoon
it’s Dec 31: baby-yoda published incompatible [email protected]
it’s Jan 1st: I install [email protected]

How to reproduce

Use only the package.json manifest
Run npm install
Check /tmp/world.txt (should be empty)
Update the package-lock.json file with the one provided in this gist
Run rm -rf node_modules/ && npm install (notice how it's necessary in this vector to remove the node_modules/ folder)
Confirm /tmp/world.txt is now created on the filesystem

References

How to reproduce

Use only the package.json manifest
Run yarn install
Check /tmp/world.txt (should be empty)
Update the yarn.lock file with the one provided in this gist
Run yarn install (or yarn install --frozen-lockfile which is also susceptible to this attack vector)
Confirm /tmp/world.txt is now created on the filesystem

What's the advantage of having a dashboard in the terminal instead of for example a webpage?

-> it’s mostly about context-switch for me. about dockly for example, it’s not just to open a webpage, you first need to run the container with the web ui, etc. I generally find it more comfortable just to say on the terminal if I can.

1. What shell do you use?
2. How did you make your terminal to look like that? :)
3.

	// This function will find all elements with the class "changelogItem published"
	// and extract the desired information, including preserving only links in the content body.
	function extractNewsItems() {
	// Get all elements with the class "changelogItem published"
	const items = document.querySelectorAll('.changelogItem.published');

	// Initialize an empty array to hold the news items
	const newsItems = [];

	// Function to process content to keep only text and anchor tags

	const fastify = require("fastify")();
	const fs = require("fs");
	const path = require("path");

	// Set the directory where uploaded files will be saved
	const UPLOADS_DIRECTORY = "uploads/";

	// Create the uploads directory if it doesn't exist
	if (!fs.existsSync(UPLOADS_DIRECTORY)) {
	fs.mkdirSync(UPLOADS_DIRECTORY);

	/* eslint-disable security/detect-non-literal-fs-filename */
	/* eslint-disable security/detect-object-injection */
	'use strict'

	const fs = require('fs')

	// const

	const filePath = process.argv[2]
	console.log('Input file is: ', filePath)