Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
github.com/joewalnes/websocketd
websocketd
is a small command-line tool that will wrap an existing command-line interface program, and allow it to be accessed via a WebSocket.
WebSocket-capable applications can now be built very easily. As long as you can write an executable program that reads STDIN
and writes to STDOUT
, you can build a WebSocket server. Do it in Python, Ruby, Perl, Bash, .NET, C, Go, PHP, Java, Clojure, Scala, Groovy, Expect, Awk, VBScript, Haskell, Lua, R, whatever! No networking libraries necessary.
Upon startup, websocketd
will start a WebSocket server on a specified port, and listen for connections.
Upon a connection, it will fork the appropriate process, and disconnect the process when the WebSocket connection closes (and vice-versa).
Any message sent from the WebSocket client will be piped to the process's STDIN
stream, followed by a \n
newline.
Any text printed by the process to STDOUT
shall be sent as a WebSocket message whenever a \n
newline is encountered.
If you're on a Mac, you can install websocketd
using Homebrew. Just run brew install websocketd
. For other operating systems, or if you don't want to use Homebrew, check out the link below.
Download for Linux, OS X and Windows
To get started, we'll create a WebSocket endpoint that will accept connections, then send back messages, counting to 10 with 1 second pause between each one, before disconnecting.
To show how simple it is, let's do it in Bash!
count.sh:
#!/bin/bash
for ((COUNT = 1; COUNT <= 10; COUNT++)); do
echo $COUNT
sleep 1
done
Before turning it into a WebSocket server, let's test it from the command line. The beauty of websocketd
is that servers work equally well in the command line, or in shell scripts, as they do in the server - with no modifications required.
$ chmod +x count.sh
$ ./count.sh
1
2
3
4
5
6
7
8
9
10
Now let's turn it into a WebSocket server:
$ websocketd --port=8080 ./count.sh
Finally, let's create a web-page to test it.
count.html:
<!DOCTYPE html>
<pre id="log"></pre>
<script>
// helper function: log message to screen
function log(msg) {
document.getElementById('log').textContent += msg + '\n';
}
// setup websocket with callbacks
var ws = new WebSocket('ws://localhost:8080/');
ws.onopen = function() {
log('CONNECT');
};
ws.onclose = function() {
log('DISCONNECT');
};
ws.onmessage = function(event) {
log('MESSAGE: ' + event.data);
};
</script>
Open this page in your web-browser. It will even work if you open it directly
from disk using a file://
URL.
websocketd --help
.More documentation in the user manual
Got more examples? Open a pull request.
And follow @joewalnes!
FAQs
Unknown package
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.