Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
@devsnicket/eunice
Advanced tools
Analyzes JavaScript on the file system, processes the analysis and renders the processed analysis to an SVG.
DevSnicket Eunice is a toolkit based on the premise that unidirectional dependencies can be beneficial to structure and modularity in software. Eunice's approach isn't limited to direct dependencies, but includes indirect dependencies as well.
try out Eunice on some Javascript
This package brings together JavaScript analysis, an example configuration to process that analysis and a render of the processed analysis. A description of how these stages work can be found in the main Eunice repository.
To try the package out on JavaScript source code in the current directory the following npx command can be used:
npx eunice
The package produces the following output files:
a YAML file containing processed analysis (eunice.yaml)
(runs JavaScript analyzer and processors)
an SVG file containing a render scoped to the root directory (eunice.svg)
(runs renderer)
a HTML file containing an interactive render, where the scope can be set to sub-items (e.g. sub-directories, files, functions etc), and dependencies can be listed (eunice.html)
(runs renderer test harness)
Install and run using npm
:
npm install --save-dev @devsnicket/eunice
npx eunice
Or with yarn
:
yarn add --dev @devsnicket/eunice
yarn eunice
This GitHub repository is named eunice-javascript, but the NPM package contained is called just eunice. This stops the main eunice repository from being JavaScript specific (e.g. for multiple analysis sources and programming languages), but gives this package a shorter name. An additional package without the @devsnicket scope is also created that redirects to the scoped package.
From the processors available in eunice-processors, this package runs the following automatically, the same processing as Eunice uses when analyzing itself:
Only the current directory is included in analysis by default. Multiple sources of analysis can be specified:
npx @devsnicket/eunice --directories=directory1 --directories=directory2
An identifier for a root item can also be specified for each source directory to be used in processing step 2:
npx @devsnicket/eunice --directories=directory1 --rootItemIdentifiers=prefixForDirectory1 --directories=directory2 --rootItemIdentifiers=prefixForDirectory2
The following sub-directories are ignored by default:
A new list of sub-directories to be ignored can be specified:
npx @devsnicket/eunice --ignoreDirectoryNames=ignoreDirectory1 --ignoreDirectoryNames=ignoreDirectory2
Packages installed in the node_modules directory are not analysed by default. They can included using the "directories" option above or with:
npx @devsnicket/eunice --packageNames=package1 --packageNames=package2
To aid readability a package prefix and scope can also be specified that will not be visible in the rendered output:
// e.g. @scope/prefix-package
npx @devsnicket/eunice --packageNames=package --packagePrefix=prefix- --packageScope=scope
When multiple sources of analysis are specified, processing step 12 can also be applied to the combined sources:
npx @devsnicket/eunice --directories=directory1 --directories=directory2 --directoryToCreateOrAddToStacksFrom=stacks-directory
To name the output files differently or in a different directory:
npx @devsnicket/eunice --outputBaseFileName=eunice-file --outputDirectoryPath=eunice-directory
Eunice is run on itself, using this package, in a form of dogfooding. A version of this exists in this package's package.json file in the script property named "dogfooding".
FAQs
Analyzes JavaScript on the file system, processes the analysis and renders the processed analysis to an SVG.
The npm package @devsnicket/eunice receives a total of 3 weekly downloads. As such, @devsnicket/eunice popularity was classified as not popular.
We found that @devsnicket/eunice demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.