
Research
Malicious npm Packages Impersonate Flashbots SDKs, Targeting Ethereum Wallet Credentials
Four npm packages disguised as cryptographic tools steal developer credentials and send them to attacker-controlled Telegram infrastructure.
github.com/mwitkow/grpc-proxy
gRPC Go Proxy server
Build a transparent reverse proxy for gRPC targets that will make it easy to expose gRPC services over the internet. This includes:
The project now exists as a proof of concept, with the key piece being the proxy
package that
is a generic gRPC reverse proxy handler.
The package proxy
contains a generic gRPC reverse proxy handler that allows a gRPC server to
not know about registered handlers or their data types. Please consult the docs, here's an exaple usage.
You can call proxy.NewProxy
to create a *grpc.Server
that proxies requests.
director = func(ctx context.Context, fullMethodName string) (context.Context, *grpc.ClientConn, error) {
// Make sure we never forward internal services.
if strings.HasPrefix(fullMethodName, "/com.example.internal.") {
return nil, nil, status.Errorf(codes.Unimplemented, "Unknown method")
}
md, ok := metadata.FromIncomingContext(ctx)
if ok {
// Decide on which backend to dial
if val, exists := md[":authority"]; exists && val[0] == "staging.api.example.com" {
// Make sure we use DialContext so the dialing can be cancelled/time out together with the context.
conn, err := grpc.DialContext(ctx, "api-service.staging.svc.local", grpc.WithCodec(proxy.Codec()))
return ctx, conn, err
} else if val, exists := md[":authority"]; exists && val[0] == "api.example.com" {
conn, err := grpc.DialContext(ctx, "api-service.prod.svc.local", grpc.WithCodec(proxy.Codec()))
return ctx, conn, err
}
}
return nil, nil, status.Errorf(codes.Unimplemented, "Unknown method")
}
Then you need to register it with a grpc.Server
. The server may have other handlers that will be served
locally.
server := grpc.NewServer(
grpc.CustomCodec(proxy.Codec()),
grpc.UnknownServiceHandler(proxy.TransparentHandler(director)))
pb_test.RegisterTestServiceServer(server, &testImpl{})
To make debugging a bit simpler, there are some helpers.
testservice
contains a method TestTestServiceServerImpl
which performs a complete test against
the reference implementation of the TestServiceServer
.
In proxy_test.go
, the test framework spins up a TestServiceServer
that it tests the proxy
against. To make debugging a bit simpler (eg. if the developer needs to step into
google.golang.org/grpc
methods), this TestServiceServer
can be provided by a server by
passing -test-backend=addr
to go test
. A simple, local-only implementation of
TestServiceServer
exists in testservice/server
.
grpc-proxy
is released under the Apache 2.0 license. See LICENSE.txt.
FAQs
Unknown package
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Four npm packages disguised as cryptographic tools steal developer credentials and send them to attacker-controlled Telegram infrastructure.
Security News
Ruby maintainers from Bundler and rbenv teams are building rv to bring Python uv's speed and unified tooling approach to Ruby development.
Security News
Following last week’s supply chain attack, Nx published findings on the GitHub Actions exploit and moved npm publishing to Trusted Publishers.