-
-
Notifications
You must be signed in to change notification settings - Fork 2.5k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Add windows/darwin support to npm_packages #7536
Add windows/darwin support to npm_packages #7536
Conversation
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Small nit from me, but I'll leave the review to a non-coworker
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Thanks @terracatta! This is super useful -- I think there is only one small merge conflict to be resolved
@sharvilshah I fixed the conflict, I'm not sure why that one test failed it looks like it was just a random timeout? |
I've kicked a new build and yeah, it's a known flaky test. |
GitHub status says mac actions are being slooooowwwww |
What Does This PR Do?
This PR does three things:
npm_packages
table so that it runs on every compatible osquery platform (including Windows and macOS).homepage
key from thepackage.json
file to the schema as a new column.Default run on macOS
Run on macOS with custom directory
Default Run on Windows 10
Why Is This Useful?
There have been a number of high-profile supply-chain attacks involving npm_packages. While the current table can help locate compromised packages in production environments, it's also useful to scan for them on a developer's device directly. Many NPM packages can be installed globally and are available in the the user's $PATH.
By expanding to more operating systems, we can drastically improve detection of these nefarious packages.
Implementation
This PR mostly apes the cross-platform implementation of the
python_packages
table and combines in all the previous work done on this table under linux.