Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
@appland/appmap-agent-js
Advanced tools
JavaScript client agent for the AppMap framework.
To install:
npm install @appland/appmap-agent-js
To run:
npx appmap-agent -- main.mjs argv0 argv1
unix-like os
node v14.x
git
curl >= 7.55.0
--experimental-loader
requires >= nodev9.0.0
NODE_OPTIONS
requires >= nodev8.0.0
--require
requires >= nodev1.6.0
npx appmap-agent <method> <options> -- <command>
At the moment there is only one method. In the future, new functionalities will be added here.
spawn
: Spawn a node process (the default method).The command you would normally run (including the node
command if applicable).
For instance:
node script.js argv0 argv1
node module.mjs argv0 argv1
globally-installed-module argv0 argv1
npx locally-installed-module argv0 argv1
--node-version = 14.x | 15.x | 16.x
, default 14.x
: Indicate with which node version the recording should be compatible with. If the command is executing an older node version, a runtime error will be thrown. We are working toward supporting older node versions.--no-hook-cjs
: Disable instrumentation of commonjs modules (enabled by default).--no-hook-esm
: Disable instrumentation of (native) es2015 modules (enabled by default).--rc-file = ...
, default ./appmap.yml
: Path to configuration file.--protocol = inline | messaging | http1 | http2
, default messaging
: Specify the communication protocol between the process that is managing the code instrumentation and the process that is executing the instrumented code.
inline
: Simplest but does not prevent the program under test to mess with the recording. For instance:
process.removeAllListeners('exit')
.global.String.prototype.substring = null
.messaging
: Simple TCP messaging protocol (faster than http1
and http2
).http1
http2
--port = ...
, default 0
: Specify the TCP port to perform the inter-process communication (0
will assign a random port). Path to unix domain sockets are also accepted. This option has no effect if the protocol is set to "inline"
.FAQs
`appmap-agent-js` is a JavaScript recording agent for the [AppMap](https://appmap.io) framework.
The npm package @appland/appmap-agent-js receives a total of 496 weekly downloads. As such, @appland/appmap-agent-js popularity was classified as not popular.
We found that @appland/appmap-agent-js demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 4 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.