Research
Security News
Malicious npm Package Targets Solana Developers and Hijacks Funds
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
github.com/gleez/smtpd
A Lightweight High Performance SMTP written in Go, made for receiving large volumes of mail, parse and store in mongodb. The purpose of this daemon is to grab the email, save it to the database and disconnect as quickly as possible.
This server does not attempt to check for spam or do any sender verification. These steps should be performed by other programs. The server does NOT send any email including bounces. This should be performed by a separate program.
The most alluring aspect of Go are the Goroutines! It makes concurrent programming easy, clean and fun! Go programs can also take advantage of all your machine's multiple cores without much effort that you would otherwise need with forking or managing your event loop callbacks, etc. Golang solves the C10K problem in a very interesting way http://en.wikipedia.org/wiki/C10k_problem
Once compiled, Smtpd does not have an external dependencies (HTTP, SMTP are all built in).
SMTPD is currently production quality: it is being used for real work.
You will need a functioning [Go installation][Golang] for this to work.
Grab the Smtpd source code and compile the daemon:
go get -v github.com/gleez/smtpd
Edit etc/smtpd.conf and tailor to your environment. It should work on most Unix and OS X machines as is. Launch the daemon:
$GOPATH/bin/smtpd -config=$GOPATH/src/github.com/gleez/smtpd/etc/smtpd.conf
By default the SMTP server will be listening on localhost port 25000 and the web interface will be available at localhost:10025.
This will place smtpd in the background and continue running
/usr/bin/nohup /home/gleez/smtpd -config=/home/gleez/smtpd.conf -logfile=smtpd.log 2>&1 &
You may also put another process to watch your smtpd process and re-start it if something goes wrong.
Nginx can be used to proxy SMTP traffic for GoGuerrilla SMTPd
Why proxy SMTP?
mail {
#This is the URL to Smtpd's http service which tells Nginx where to proxy the traffic to
auth_http 127.0.0.1:10025/auth-smtp;
server {
listen 15.29.8.163:25;
protocol smtp;
server_name smtp.example.com;
smtp_auth none;
timeout 30000;
smtp_capabilities "PIPELINING" "8BITMIME" "SIZE 20480000";
# ssl default off. Leave off if starttls is on
#ssl on;
ssl_certificate /etc/ssl/certs/ssl-cert-snakeoil.pem;
ssl_certificate_key /etc/ssl/private/ssl-cert-snakeoil.key;
ssl_session_timeout 5m;
ssl_protocols SSLv2 SSLv3 TLSv1;
ssl_ciphers HIGH:!aNULL:!MD5;
ssl_prefer_server_ciphers on;
# TLS off unless client issues STARTTLS command
starttls on;
proxy on;
xclient on;
}
}
Copyright © 2014, Gleez Technologies (http://www.gleeztech.com).
Released under MIT license, see LICENSE for details.
FAQs
Unknown package
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
Security News
Research
Socket researchers have discovered malicious npm packages targeting crypto developers, stealing credentials and wallet data using spyware delivered through typosquats of popular cryptographic libraries.
Security News
Socket's package search now displays weekly downloads for npm packages, helping developers quickly assess popularity and make more informed decisions.