
Research
Malicious NuGet Packages Typosquat Nethereum to Exfiltrate Wallet Keys
The Socket Threat Research Team uncovered malicious NuGet packages typosquatting the popular Nethereum project to steal wallet keys.
@botique/smartmon
Advanced tools
Automatically restart your NodeJS process when one of the dependencies changes
smartmon
is a small cli tool to automatically restart your nodejs application
when a change occurs in any of the files required by your main script (including symlinked node_modules!).
Current tools used for automatically restarting your node process, are based on watching directories and files defined by the developer. In certain scenarios, this means watching files that are not really apart of your application, meaning unnecessary restarts.
Also, in a monorepo, you probably want to restart your node server when there is a change in another package dependency. Using directory watching to watch the folder in the node_modules would also mean watching files that are not actually related to your running node process.
Install smartmon
globally:
npm:
npm i -g @botique/smartmon
yarn:
yarn global add @botique/smartmon
run your script with smartmon:
smartmon main.js
smartmon
currently comes with no configuration options. All flags are passed to the node process. You can use debugging flags and more as usual.
smartmon
's smarts are powered by two awesome libraries: depedency-tree
and watchpack
. dependency-tree
is used to
find all the files that are required by your main script (and their dependencies) and watchpack is used for the same
abstraction it is used by webpack, keeping the amount of watchers minimal when watching lots of files, that could be
located across directories.
FAQs
Automatically restart your NodeJS process when one of the dependencies changes
The npm package @botique/smartmon receives a total of 10 weekly downloads. As such, @botique/smartmon popularity was classified as not popular.
We found that @botique/smartmon demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
The Socket Threat Research Team uncovered malicious NuGet packages typosquatting the popular Nethereum project to steal wallet keys.
Product
A single platform for static analysis, secrets detection, container scanning, and CVE checks—built on trusted open source tools, ready to run out of the box.
Product
Socket is launching experimental protection for the Hugging Face ecosystem, scanning for malware and malicious payload injections inside model files to prevent silent AI supply chain attacks.