Research
Security News
Malicious npm Package Targets Solana Developers and Hijacks Funds
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
github.com/gwuhaolin/lightsocks
一个轻量级网络混淆代理,基于 SOCKS5 协议,可用来代替 Shadowsocks。
想了解 Lightsocks 的实现原理?请阅读文章:你也能写个 Shadowsocks。
去 releases 页下载最新的可执行文件,注意选择正确的操作系统和位数(Mac 系统内核为 darwin)。 解压后会看到2个可执行文件,分别是:
在代理服务器下载好 lightsocks-server 后,执行命令:
./lightsocks-server
就可启动服务端,启动成功后会输出如下日志:
服务监听地址 listen:
:12315
密码 password:
******
假如服务器的 IP 是 45.56.76.5,则以上日志的含义是指:
45.56.76.5:12315
,监听端口12315是随机生成的;******
除此之外你还可以通过 Docker 快速启动。
在本地电脑下载好 lightsocks-local 后,执行命令:
./lightsocks-local
就可启动本地代理客户端,会看到如下日志:
2017/10/11 10:03:16 保存配置到文件 /Users/username/.lightsocks.json 成功
2017/10/11 10:03:16 lightsocks-client:master 启动成功 监听在 [::]:7448
这表明生成了一份配置文件到 /Users/username/.lightsocks.json
。
为了让客户端用指定的密码去连接服务器,需要给客户端传入参数,为此需要修改该配置文件为如下:
{
"remote": "45.56.76.5:12315",
"password": "******"
}
重新启动 lightsocks-local 后,再使用监听在 127.0.0.1:7448
的本地 SOCK5 服务就可以正常使用了。
都启动成功后,可参考 搭配 Chrome 使用 配置你的 Chrome。
$ sudo vim /Library/LaunchDaemons/lightsocks.plist
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>KeepAlive</key>
<true/>
<key>RunAtLoad</key>
<true/>
<key>Label</key>
<string>lightsocks</string>
<key>ProgramArguments</key>
<array>
<string>/usr/local/bin/lightsocks-local</string>
<string>/Users/macOS-username/.lightsocks.json</string>
</array>
<key>StandardOutPath</key>
<string>/var/log/lightsocks.log</string>
<key>StandardErrorPath</key>
<string>/var/log/lightsocks.log</string>
</dict>
</plist>
启用开机自启动:
sudo launchctl load -w /Library/LaunchDaemons/lightsocks.plist
关闭开机自启动:
sudo launchctl stop /Library/LaunchDaemons/lightsocks.plist
sudo launchctl unload -w /Library/LaunchDaemons/lightsocks.plist
lightsocks-local your-name.json
启动,这时配置文件会保存到 ~/your-name.json
中。~/.lightsocks.json
文件中,启动前会去 ~/.lightsocks.json
文件中读取配置,你可以在启动前修改~/.lightsocks.json
文件来应用你需要的配置,格式如下:{
"remote": "45.56.76.5:7448",
"password": "******",
"listen": "127.0.0.1:7448"
}
FAQs
Unknown package
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
Security News
Research
Socket researchers have discovered malicious npm packages targeting crypto developers, stealing credentials and wallet data using spyware delivered through typosquats of popular cryptographic libraries.
Security News
Socket's package search now displays weekly downloads for npm packages, helping developers quickly assess popularity and make more informed decisions.