Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
github.com/forkproject/dog-tunnel-lite
This tunnel is a lite version if dog-tunnel, and actions without a middle server, has no ability of udp traversal, but simple and faster
the server side should have a public ip , such as xxx.xxx.xxx.xxx, please replace it with your own ip first, start a server server: ./dtunnel_lite -v -service 127.0.0.1:1234 -dnscache 10
then start a client, you can seed the example below: socks5 example: client: ./dtunnel_lite -v -service xxx.xxx.xxx.xxx:1234 -local :8787
Then you can connect to socks5 proxy with 127.0.0.1:8787
Here is some useful scripts:
# server side dtunnel_lite
#!/bin/sh
killall -9 dtunnel_lite
sleep 2
nice -n -20 /bin/dtunnel_lite -service 0.0.0.0:18080 -auth asecuritypassword &
# client side dtunnel_lite
#!/bin/sh
killall -9 dtunnel_lite
dtunnel_lite -service this.is.your.serverip:18080 -local :8070 -auth asecuritypassword &
ssh port forward example: client: ./dtunnel_lite -v -service 127.0.0.1:1234 -local :8787 -action :22
It's better to add the -encrypt arg for privacy in client you can add "-auth" on both sides for authorize
The default mode is udp mode, and is faster in the poor network than tcp mode, you can also use tcp mode with "-tcp" on both sides.
author: vzex@163.com
FAQs
Unknown package
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.