Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
github.com/cameronhunter/local-ssl-proxy
Simple SSL HTTP proxy using a self-signed certificate. Intended for local development only.
The package supports immediate use via npx
or you can install it
globally.
Use via npx
:
npx local-ssl-proxy
Install globally:
npm install -g local-ssl-proxy
To start a proxy from port 9001
to 9000
run:
local-ssl-proxy --source 9001 --target 9000
Start your web server on the target port (9000
in the example) and navigate to https://localhost:<source-port>
(https://localhost:9001 in the example). You'll get a warning because the certificate is self-signed, this is safe to ignore during development.
Using a dynamic DNS provider such as noip or DynDNS or a static IP (if you have one) you can open a port in your firewall to allow external sites to call into your web server. This is great for developing applications using OAuth without having to deploy externally.
You can also pass a configuration file, this helps share setups with team members. These can contain multiple proxies that local-ssl-proxy
will open concurrently.
Example config:
{
"My proxy": {
"source": 3001,
"target": 3000,
"key": "localhost-key.pem",
"cert": "localhost.pem",
"hostname": "localhost"
},
"Another proxy": {
"source": 9999,
"target": 9000,
"key": "localhost-key.pem",
"cert": "localhost.pem",
"hostname": "localhost"
}
}
And run the proxy with the configuration file:
local-ssl-proxy --config config.json
You can use it to host any domain, just change localhost to anything you like, wildcards are also supported.
choco install mkcert
/ brew install mkcert
)mkcert -install
mkcert localhost
local-ssl-proxy --key localhost-key.pem --cert localhost.pem --source 9001 --target 9000
FAQs
Unknown package
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.