Research
Security News
Quasar RAT Disguised as an npm Package for Detecting Vulnerabilities in Ethereum Smart Contracts
Socket researchers uncover a malicious npm package posing as a tool for detecting vulnerabilities in Etherium smart contracts.
@alshakero/ez-s
Advanced tools
Serving HTTP for development is fairly easy. Serving HTTPS is not. This tools gives your HTTP an easy S.
EZ-S is a fork of zeit/serve that gives you the ability to locally run a green-badge HTTPS server with zero configuration! No certificate creation, no tunnels, no hassle. Just run ez-s
and access https://ez-s.io:5000
to see your folder served with a lovely green badge 🤯. Test your Service Workers, secure cookies etc.. (but how?).
Firstly, install the package using Yarn or NPM (you'll need at least Node.js LTS):
yarn global add @alshakero/ez-s
# or
npm install -g @alshakero/ez-s
Sadly, there is another package called ezs. And NPM won't let me publish my package unscoped due to name similiarity..
Once that's done, you can run this command inside your project's directory:
ez-s
Finally, run this command to see a list of all available options:
ez-s --help
Now you understand how the package works! :tada:
If you're fimiliar with serve
, ez-s
accepts exactly the same arguments except -l, --listen
. It accepts --port
instead. The reasoning is explained in How this works section below.
ez-s.io
has a single A
DNS record pointing to the IP address 127.0.0.1
.ez-s.io
the certificate provided will actually match letsecrypt's, the IP address of the host does not matter. As long as letsencrypt records match the certificates provided by the server, Chrome will not object.Wait what? Public private keys?! Yes. Because the domain will forever point to 127.0.0.1, impersonating it will not take the impersonator anywhere. Unless the impersonator has power over the victims DNS server, which makes ez-s the least of the victim's worries 😁
Since ez-s.io
points to localhost
, your app will be only accessible locally. You can't test it on your phone or using another machine. Using a SauceLabs tunnel would perfectly work though.
Due to this caveat, serve
's --listen
argument is useless in this case. The only configurble network-related parameter is the port.
Please see serve
's configuration section.
If you like it, please give it a star ⭐
ez-s
if it's already installed: npm uninstall -g @alshakero/ez-s
npm link
After that, you can use the ez-s
command everywhere.
serve
You can download the certificates from certs
folder and use them with any server you want. After you set your server up, access https://ez-s.io
and it should work.
--tunnel
argument. This argument will locally tunnel your own HTTP server to an HTTPS endpoint. All on your machine in a single command.This project is almost identical to Zeit's. The best part of the credit goes to them. My idea was to offer HTTPS and found it wasteful to re-create the underlaying HTTP logic. Huge thanks to Zeit!
Omar Alshaker
FAQs
Zero-config HTTPS static file serving and directory listing
We found that @alshakero/ez-s demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket researchers uncover a malicious npm package posing as a tool for detecting vulnerabilities in Etherium smart contracts.
Security News
Research
A supply chain attack on Rspack's npm packages injected cryptomining malware, potentially impacting thousands of developers.
Research
Security News
Socket researchers discovered a malware campaign on npm delivering the Skuld infostealer via typosquatted packages, exposing sensitive data.