Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
@667/ngrok-dns
Advanced tools
Ngrok-dns is a plugin of sorts to the ngrok npm package that enables domain features of ngrok which are not available on the free plan. Ngrok-dns will create a TXT record pointing to the new tunnel each time it changes.
Further you can generate a fixed URL using the service at https://ngrok-dns.june07.com.
ngrok tunnel url is dynamic and will change during your development cycle |
cloudflare TXT records can then be easily accessed from webhooks and other disconnected parts of dev project |
npm install @667/ngrok-dns
[ | |
---|---|
highlighed locations show requirement for ngrok-dns usage | similar setup for localtunnel usage |
const ngrok = require('./index'),
ngrokDNS = require('@667/ngrok-dns');
(async function () {
const url = await ngrok.connect({
addr: 'https://localhost:3000',
onLogEvent: ngrokDNS
});
})();
const localtunnel = require('localtunnel'),
dnsTunnel = require('@667/ngrok-dns');
(async () => {
const tunnel = await localtunnel({
port: 3000,
allow_invalid_cert: true,
local_https: true,
debug: true,
});
dnsTunnel(tunnel.url);
console.log(`dnsTunnel: ${tunnel.url}`);
})();
Make sure your env vars are set and run your app or app dev command (i.e. nodemon, etc) as normal:
require('dns')
Log output should look like:
ngrok-dns added Cloudflare TXT your-custom-domain.com -> 0d8b12e869d7.ngrok.io
This is a seperate example of ngrok-dns output:
Currently Cloudflare (token based) is supported although other DNS providers should be easy to add.
FAQs
DNS plugin for ngrok
We found that @667/ngrok-dns demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.