Research
Security News
Malicious npm Package Targets Solana Developers and Hijacks Funds
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
github.com/yiyuezhuo/xisocks2
Yet another toy proxy which provide authentication and removing verbose handshake procedure as much as possible, compared to previous version.
This protocol is inspired by v2ray
and trojan
.
All socks5/https handshake will be treated successed to accelerate transport. When proxed app such as browser, client start a TLS connection to connect remote server outside GFW. When TLS connection have been established, a header with payload will be sent to server to specify TCP CONNECT destination and payload to reduce packet required to transport.
+----------------+--------------+--------------+-------------+---------------+
| len(TOKEN) | TOKEN | len(host) | host | Payload |
+-------------------------------+--------------+-----------------------------+
| 1 byte | 1-255 bytes | 1 byte | 1-255 bytes | * |
+----------------+--------------+--------------+-------------+---------------+
When server take a wrong header format, it will forward the suspicious request to a local http server. So that you and GFW internet agent may find that a website is hosted in that url if just access it from browser.
My personal interest is to show a sad panda to GFW internet agent, or you may launch a jupyter notebook server, which provide powerfull screen-like terminor.
$ go get github.com/gorilla/websocket
$ go get github.com/yiyuezhuo/xisocks2
Enter project root
$ make
server.crt
and server.key
and placing them into server root.client.exe
(windows) or ./client
(linux)server.exe
(windows) or ./server
(linux)In addtiontion to PC usage, the android version is just compiled using GOARCH=arm64
and GOOS=linux
.
No UI is provided, you can use
termux
and
Postern
to help you use xisocks2
just like usage for other console-oriented applications such as v2ray-core
. Note Data Sniffer
in Rule
in Postern
should be enable.
FAQs
Unknown package
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
Security News
Research
Socket researchers have discovered malicious npm packages targeting crypto developers, stealing credentials and wallet data using spyware delivered through typosquats of popular cryptographic libraries.
Security News
Socket's package search now displays weekly downloads for npm packages, helping developers quickly assess popularity and make more informed decisions.