Research
Security News
Malicious npm Package Targets Solana Developers and Hijacks Funds
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
crawshaw.io/littleboss
A Go package, littleboss lets you turn your program into a a self-supervising binary. It starts itself as a child process, monitors its life cycle, reloads it if it exits, and can be instructed to replace it with a new binary.
The supervisor can open sockets for you and share them across reloads of your program, ensuring no connections are dropped.
You can install it with:
go get crawshaw.io/littleboss
Make a program use littleboss by modifying the main function:
func main() {
lb := littleboss.New("service-name")
lb.Run(func(ctx context.Context) {
// main goes here, exit when <-ctx.Done()
})
}
The service name is used to identify which program the supervisor will control.
By default the supervisor is bypassed and the program executes directly. A flag, -littleboss, is added to the binary. It can be used to start a supervised binary and manage it:
$ mybin & # binary runs directly, no child process
$ mybin -littleboss=start & # supervisor is created
$ mybin2 -littleboss=reload # child is replaced by new mybin2 process
$ mybin -littleboss=stop # supervisor and child are shut down
Supervisor options are baked into the binary. The littleboss struct type contains fields that can be set before calling the Run method to configure the supervisor. Options include reloading the previous binary if a reload fails, controlling how long an exiting program has to turn down its connections, and specifying exactly what flags control and are passed by littleboss.
func main() {
lb := littleboss.New("myblog")
flagHTTPS := lb.Listener("https", "tcp", ":443", "address")
lb.Run(func(ctx context.Context) {
httpMain(ctx, flagHTTPS.Listener())
})
}
func httpMain(ctx context.Context, ln net.Listener) {
srv := &http.Server{
ReadTimeout: 10 * time.Second,
WriteTimeout: 10 * time.Second,
IdleTimeout: 60 * time.Second,
Handler: blogHandler,
}
go func() {
if err := srv.ServeTLS(ln, "certfile", "keyfile"); err != nil {
if err == http.ErrServerClosed {
return
}
log.Fatal(err)
}
}()
<-ctx.Done()
srv.Shutdown(ctx)
}
FAQs
Unknown package
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
Security News
Research
Socket researchers have discovered malicious npm packages targeting crypto developers, stealing credentials and wallet data using spyware delivered through typosquats of popular cryptographic libraries.
Security News
Socket's package search now displays weekly downloads for npm packages, helping developers quickly assess popularity and make more informed decisions.