
Research
2025 Report: Destructive Malware in Open Source Packages
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.
github.com/signeen/inspect-http-proxy
Advanced tools
A simple yet powerful Go-based reverse HTTP proxy designed for detailed inspection of requests and responses. It logs traffic to the console with colorization, automatic decompression, and formatting for common content types, while remaining transparent to the client application.
Ideal for debugging API interactions, understanding middleware behavior, or simply getting a clear view of HTTP traffic flow.
gzip, br (Brotli), and deflate encoded response bodies before logging, allowing you to see the actual content easily.application/x-www-form-urlencoded bodies.-listen).-target).-truncate-log-body).Authorization header value in logs.X-Forwarded-For, X-Forwarded-Proto, and X-Forwarded-Host headers to the request sent to the target.You can install the proxy directly using go install:
go install github.com/signeen/inspect-http-proxy@latest
Alternatively, you can clone the repository and build it manually:
git clone https://github.com/signeen/inspect-http-proxy.git
cd inspect-http-proxy
go build
Run the proxy from your terminal, specifying the target URL.
inspect-http-proxy -target <target-url> [flags]
Flags:
-listen <address:port>: Address and port for the proxy to listen on. (Default: :20003)-target <url>: URL of the target server to forward requests to. (Required, e.g., http://localhost:8080, https://api.example.com)-truncate-log-body: If set, truncate the logged body output string to a predefined limit (currently 10KB). (Default: false)Examples:
Proxy to a local backend API:
inspect-http-proxy -target http://localhost:8080
Now send requests to http://localhost:20003 instead of http://localhost:8080.
Listen on a different port and proxy to HTTPS:
inspect-http-proxy -listen :9999 -target https://jsonplaceholder.typicode.com
Send requests to http://localhost:9999.
Proxy and truncate long log bodies:
inspect-http-proxy -target http://my-verbose-api:5000 -truncate-log-body
Here's a sample of what the console output might look like (colors omitted for basic Markdown):

--- Incoming Request ---
Time: 2025-04-04T10:30:01Z
From: 127.0.0.1:54321
Request: POST /api/v1/users HTTP/1.1
Host: localhost:20003
Query Parameters:
source: web
Request Headers:
Accept: application/json
Accept-Encoding: gzip, deflate, br
Authorization: [REDACTED SHORT]
Content-Length: 55
Content-Type: application/json
User-Agent: curl/7.79.1
Request Body: (decoded from json for printing)
{
"email": "test@example.com",
"name": "Test User"
}
------------------------
--- Target Response ----
Status: 201 Created (201)
Response Headers:
Content-Encoding: gzip
Content-Type: application/json; charset=utf-8
Date: Fri, 04 Apr 2025 10:30:01 GMT
Location: /api/v1/users/123
Server: Caddy
Vary: Accept-Encoding
Response Body: (decoded from gzip for printing)
{
"id": "123",
"message": "User created successfully",
"timestamp": "2025-04-04T10:30:01.500Z"
}
Duration: 55.123456ms
-----------------------
=======================
--- Incoming Request ---
Time: 2025-04-04T10:31:05Z
From: 127.0.0.1:54322
Request: GET /api/v1/items?limit=10 HTTP/1.1
Host: localhost:20003
Query Parameters:
limit: 10
Request Headers:
Accept: */*
Accept-Encoding: gzip
User-Agent: Wget/1.21.1
Request Body: (empty)
------------------------
--- Target Response ----
Status: 200 OK (200)
Response Headers:
Content-Length: 25000
Content-Type: application/json
Date: Fri, 04 Apr 2025 10:31:05 GMT
Server: nginx
Response Body: (decoded from json for printing)
[
{
"id": "item1",
"value": "..."
},
{
"id": "item2",
"value": "..."
}
// ... more items
]
... (Output truncated for display, original data size 25000 bytes)
Duration: 12.987654ms
-----------------------
=======================
Contributions are welcome! Please feel free to open an issue to report bugs or suggest features, or submit a pull request with improvements.
This project is licensed under the GNU General Public License v3.0 - see the LICENSE file for details.
FAQs
Unknown package
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.

Security News
Socket CTO Ahmad Nassri shares practical AI coding techniques, tools, and team workflows, plus what still feels noisy and why shipping remains human-led.

Research
/Security News
A five-month operation turned 27 npm packages into durable hosting for browser-run lures that mimic document-sharing portals and Microsoft sign-in, targeting 25 organizations across manufacturing, industrial automation, plastics, and healthcare for credential theft.