Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
@dwelle/tunnel-rat
Advanced tools
Create a tunnel:
import tunnel from 'tunnel-rat'
const t = tunnel()
Use the tunnel's In
component to send one or more elements into the tunnel:
<t.In>
<h1>Very cool!</h1>
<p>These will appear somewhere else!</p>
</t.In>
Somewhere else, use the tunnel's Out
component to render them:
<t.Out />
This example describes a simple React app that has both a HTML UI as well as a @react-three/fiber 3D scene. Each of these is rendered using separate React renderers, which traditionally makes emitting HTML from within the Canvas a bit of a pain; but thanks to tunnel-rat, this is now super easy!
import { Canvas } from '@react-three/fiber'
import tunnel from 'tunnel-rat'
/* Create a tunnel. */
const ui = tunnel()
const App = () => (
<div>
<div id="ui">
{/* Anything that goes into the tunnel, we want to render here. */}
<ui.Out />
</div>
{/* Here we're entering the part of the app that is driven by
@react-three/fiber, where all children of the <Canvas> component
are rendered by an entirely separate React renderer, which would
typically not allow the use of HTML tags. */}
<Canvas>
{/* Let's send something into the tunnel! */}
<ui.In>
<p>Hi, I'm a cube!</p>
</ui.In>
<mesh>
<boxGeometry />
<meshBasicMaterial />
</mesh>
{/* You can send multiple things through the tunnel, and
they will all show up in the order that you've defined them in! */}
<ui.In>
<p>And I'm a sphere!</p>
</ui.In>
<mesh>
<sphereGeometry />
<meshBasicMaterial />
</mesh>
</Canvas>
</div>
)
Of course, the whole thing also works the other way around:
import { Canvas } from '@react-three/fiber'
import tunnel from 'tunnel-rat'
/* Create a tunnel. */
const three = tunnel()
const App = () => (
<div>
<div id="ui">
{/* Let's beam something into the R3F Canvas! */}
<three.In>
<mesh>
<sphereGeometry />
<meshBasicMaterial />
</mesh>
</three.In>
</div>
<Canvas>
{/* Render anything sent through the tunnel! */}
<three.Out />
</Canvas>
</div>
)
FAQs
non gratum anus rodentum
We found that @dwelle/tunnel-rat demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.