# blue-emu

> For security research testing only. Not for production use.

Latest version **2.0.7** (published 2021-02-26) · ISC license · 0 weekly downloads

## Install

```sh
npm install blue-emu
pnpm add blue-emu
yarn add blue-emu
bun add blue-emu
```

## Health

**Score 15/100 (F)** — status: abandoned.

Positive: no vulnerabilities.

Warnings: low downloads; no types; no esm support.

Negative: abandoned; low maintenance score.

## Facts

| | |
|---|---|
| Version | 2.0.7 |
| Published | 2021-02-26 |
| First published | 2021-02-25 |
| Weekly downloads | 0 |
| License | ISC |
| TypeScript types | none |
| Module format | CommonJS |
| Dependencies | 1 |
| Unpacked size | 1.9 KB |
| Known vulnerabilities | 0 |
| Install scripts | yes |
| GitHub stars | 1 |
| Maintainers | zackwoo808 |

## Links

- npm: https://www.npmjs.com/package/blue-emu
- Repository: https://github.com/zackwoo808/blue-emu
- Homepage: https://github.com/zackwoo808/blue-emu#readme
- Issues: https://github.com/zackwoo808/blue-emu/issues
- npm.io page: https://npm.io/package/blue-emu

## Dependencies (1)

- [lodash](https://npm.io/package/lodash.md) ^4.17.19

## Recent versions

- 2.0.7 (latest) — 2021-02-26
- 2.0.6 — 2021-02-25

## README

# blue-emu

### *For security research purposes only. Not for production use.*

## Table of Contents

- [Background](#background)
- [Overview](#overview)

## <a name="background"></a> Background

- https://www.bleepingcomputer.com/news/security/researcher-hacks-over-35-tech-firms-in-novel-supply-chain-attack/
- https://medium.com/@alex.birsan/dependency-confusion-4a5d60fec610
- https://azure.microsoft.com/mediahandler/files/resourcefiles/3-ways-to-mitigate-risk-using-private-package-feeds/3%20Ways%20to%20Mitigate%20Risk%20When%20Using%20Private%20Package%20Feeds%20-%20v1.0.pdf

## <a name="overview"></a> Overview

### tldr;
it looks like if someone were to create a public package with a higher version than the internal package, this could potentially compromise a site.

-

Currently, we're under the assumption that we look for a private package withing an internal registry and find it, we don't look for newer packages externally.

1. Figure out the actual process we're using to locate internal vs external packages.
2. See if we need to make any changes in how our process works to avoid any potential leaks.
3. Verify that no manifest files for our projects are public.

## Usage

```sh
$ npm install --save blue-emu
```

Require module in `app/index.js`

```js
require('blue-emu');
```

Look for console log during app startup. Verify that it says *`public test`* and not *`private test`*.

```
*************** blue-emu public test ***************
```

---
_Source: https://npm.io/package/blue-emu · Machine-readable twin of the npm.io package page. Health data is recomputed on every publish._