Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
@funboxteam/fazio
Advanced tools
A tool for sneaking around your filesystem to find the installed npm deps you asking for.
It happens that popular npm packages are got compromised and you have to be sure that you don't have one installed on your machine. Fazio does the job.
$ npm install -g fazio
$ fazio -p 'ua-parser-js@0.7.29 || 0.8.0 || 1.0.0' -d ~
You may pass as many packages to search for, and as many directories to look through as you want using -p
& -d
flags:
$ fazio -p 'chokidar@2' -p 'fsevents@<2' -d ~/projects -d ~/work
By default Fazio also checks the globally installed deps. If you want to skip it, pass --no-global-check
flag.
You can use the package via npx without installing the Fazio globally:
$ npx @funboxteam/fazio --package 'ua-parser-js@0.7.29 || 0.8.0 || 1.0.0' --directory ~ --verbose
npx: installed 5 in 0.908s
Directories to scan:
/home/ai
/home/ai/.nvm/versions/node/v14.18.0/lib
× /home/ai/freelance/important-project/node_modules/ua-parser-js@0.7.21
× /home/ai/work/homepage/node_modules/ua-parser-js@0.7.24
→ /home/ai/projects/sandbox/node_modules/ua-parser-js@0.7.29
× /home/ai/projects/igoradamenko.com/node_modules/ua-parser-js@0.7.23
1 package found.
3 packages omitted.
0.1.2 (24.10.2021)
Fixed sudden crashes during the search.
FAQs
A tool to find an npm dep somewhere on your filesystem
The npm package @funboxteam/fazio receives a total of 0 weekly downloads. As such, @funboxteam/fazio popularity was classified as not popular.
We found that @funboxteam/fazio demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 4 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.