
Research
Malicious npm Packages Impersonate Flashbots SDKs, Targeting Ethereum Wallet Credentials
Four npm packages disguised as cryptographic tools steal developer credentials and send them to attacker-controlled Telegram infrastructure.
A pure Java implementation for SSH port tunneling that is able to understand
OpenSSH configurations which involve multiple hops to reach a target host.
This library essentially combines JSch with the ability to understand
ProxyJump
or ProxyCommand
configurations in your local ~/.ssh/config
file.
Add the following Maven dependency to your project:
<dependency>
<groupId>de.cronn</groupId>
<artifactId>ssh-proxy</artifactId>
<version>1.6</version>
</dependency>
# cat ~/.ssh/config
Host jumpHost1
User my-user
HostName jumphost1.my.domain
Host jumpHost2
User other-user
ProxyJump jumpHost1
Host targetHost
ProxyCommand ssh -q -W %h:%p jumpHost2
try (SshProxy sshProxy = new SshProxy()) {
int targetPort = 1234;
int port = sshProxy.connect("jumpHost2", "targetHost", targetPort);
try (Socket s = new Socket(SshProxy.LOCALHOST, port)) {
OutputStream out = s.getOutputStream();
InputStream in = s.getInputStream();
// ...
}
}
FAQs
Pure Java implementation to tunnel to TCP endpoints through SSH
We found that de.cronn:ssh-proxy demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Four npm packages disguised as cryptographic tools steal developer credentials and send them to attacker-controlled Telegram infrastructure.
Security News
Ruby maintainers from Bundler and rbenv teams are building rv to bring Python uv's speed and unified tooling approach to Ruby development.
Security News
Following last week’s supply chain attack, Nx published findings on the GitHub Actions exploit and moved npm publishing to Trusted Publishers.