
Research
/Security News
Toptal’s GitHub Organization Hijacked: 10 Malicious Packages Published
Threat actors hijacked Toptal’s GitHub org, publishing npm packages with malicious payloads that steal tokens and attempt to wipe victim systems.
github.com/walter-manger/go-concurrency
This project is an exploration of the concurrency techniques used in Golang.
- cmd
- hashercli
- main.go
- hashersrv
- main.go
- pkg
- hasher
- hasher.go
- api
- api.go
go run cmd/hashersrv/main.go
Will start the Hasher Service and listen on port 8080 by default.
go run cmd/hashersrv/main.go --help
2017/05/02 15:04:40 Starting Hasher Service...
-addr string
The port to listen on (default "8080")
exit status 2
From here, you can interact with the service using these endpoints:
Starts a Hasher job and returns the jobID. All Hasher jobs take 5 seconds to perform.
curl --data "password=somePassword" http://localhost:8080/hash
Example Output:
21
Waits (blocks) for the Hasher job to finish and returns the SHA512 + base64 Encoded password.
curl http://localhost:8080/hash/21
Example Output:
auSfSFKDloNDlfwJo68gFLWDtbIqzMkf8gGnd8sw9dEpMmciJAh73g9M+BzRzR6F5vQgRVoaQRwSvZaOsTVHLw==
Returns a JSON describing statistics for the running Hasher service.
curl http://localhost:8080/stats
Example Output:
{"total":2,"average": 221}
Where total
is the number of hash requests since the Hasher Service started, and average
is the average time in milliseconds that a /hash/{jobID}
took to complete.
Alternatively to running curl
, you can interact with the Hasher Service using the Hasher CLI tool.
go run cmd/hashercli/main.go
go run cmd/hashercli/main.go --help
-addr string
The address to send hash requests to (default "http://localhost:8080")
-numReq int
The number of requests to run against the address (default 10)
exit status 2
The Hasher CLI tool will make requests to the Hasher Service at random intervals with somewhat randomized passwords.
FAQs
Unknown package
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
Threat actors hijacked Toptal’s GitHub org, publishing npm packages with malicious payloads that steal tokens and attempt to wipe victim systems.
Research
/Security News
Socket researchers investigate 4 malicious npm and PyPI packages with 56,000+ downloads that install surveillance malware.
Security News
The ongoing npm phishing campaign escalates as attackers hijack the popular 'is' package, embedding malware in multiple versions.