Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
jbowen.dev/qcon
qcon
is a Go library implementing the Synology QuickConnect protocol.
QuickConnect is a service provided by Synology that allows one to access a registered Synology NAS device using a globally unique QuickConnect ID. QuickConnect will examine all known routes to the device and connect through the best available means in the following order:
QuickConnect will only use routes that it has tested for connectivity.
QuickConnect prevents the user from having to manually determine which method is best for accessing their device.
go get github.com/jamesbo13/quickconnect
Most use cases can be handled by the Resolve()
function:
import (
"context"
"github.com/jamesbo13/qcon"
)
...
ctx := context.Background()
id := "your-quick-connect-id"
// Resolve will return list of all working routes to device
// expressed as URL strings. The most preferred route will
// be listed first.
urls, err := qcon.Resolve(ctx, id)
if err != nil {
// handle error
}
// use synoURL for accessing Synology device APIs
synoURL := urls[0]
...
More control over the library behavior can be achieved by using a custom Client:
import (
"context"
"crypto/tls"
"net/http"
"github.com/jamesbo13/qcon"
)
...
ctx := context.Background()
id := "your-quick-connect-id"
// Set up a custom http.Transport and Client to control
// individual timeouts and provide server name for TLS cert checks
tr := &http.Transport{
Dial: (&net.Dialer{
Timeout: 5 * time.Second, // Timeout for TCP connection
}).Dial,
TLSHandshakeTimeout: 5 * time.Second, // Timeout for TLS handshake
TLSClientConfig: &tls.Config{
ServerName: "synology.mydomain.com", // Use this name for certificate checks
}, // useful when connecting to IP addresses rather than hostnames
}
c := &qcon.Client{
Client: &http.Client{
Timeout: 10 * time.Second, // Timeout for HTTP responses from server
Transport: tr,
},
Timeout: 20 * time.Second, // Timeout waiting for connectivity checks
}
// Resolve will return list of all working routes to device
// expressed as URL strings. The most preferred route will
// be listed first.
urls, err := c.Resolve(ctx, id)
if err != nil {
// handle error
}
// use synoURL for accessing Synology device APIs
synoURL := urls[0]
...
The standard Resolve()
function (and Client.Resolve()
method) imposes a
default 2 second timeout for its connectivity checks to the URLs it is
testing. Any route that does not respond within the two second timeout will
not be considered for connection.
Resolve()
and other methods all take the standard context.Context
parameter.
This can be used to cancel any calls to the library from another goroutine.
See the original Go blog post on context
for more details.
FAQs
Unknown package
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.