Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
github.com/leehuk/go-clicommand
clicommand provides Go CLI applications with subcommand/api-style interfaces and option/parameter handling
go get -u github.com/leehuk/go-clicommand
The clicommand library makes the creation of Go CLI applications using a subcommand interface easier. The subcommand interface is structured as a parent/child tree so the application can mimic an api, with edges of the tree running custom Handler functions and the tree providing a structured way of grouping commands, attaching option arguments and finding additional parameters.
Command objects are chained together to build a tree which has arbitrary depth, providing it follows the tree rules:
This allows building a CLI application which can mimic an API, e.g.:
./clicommand // parent, has children
./clicommand http // child of clicommand, has children itself
./clicommand http get => Handler() // child of clicommand->http, calls Handler() when run.
// Cannot have children.
./clicommand http post => Handler() // child of clicommand->http, calls Handler() when run.
// Cannot have children.
Options can be attached to the tree at any point and these are inherited along the tree, so child commands also have options from their parent commands. Options are defined as either having or not having parameters, options with parameters use double dashes and options without parameters use single dashes as selectors.
Anything the parser doesnt recognise is stored as a parameter, alloowing applications to accept things as a simple generic parameter, rather than requiring its specified as an option.
As each command and option is added to the tree with a name and description, the parser can automatically construct help information and display it when the program is run without parameters, or the 'help' command is used. The following example uses the sample helloworld program from https://git.io/vNDug
[golang@908222b2e8aa helloworld]$ ./helloworld help
helloworld - Sample hello world program
helloworld [-u] [-lower]
helloworld options:
-u Uppercase output
-lower Lowercase output
Available subcommands:
hello Says hello world
say Says something
For help information run:
'helloworld help' .. 'helloworld <commands>* help' .. 'helloworld [commands]* help [subcommand]*'
[golang@908222b2e8aa helloworld]$
A sample helloworld.go program can be found under examples.
FAQs
Unknown package
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.