Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
@kmr/my-dash
Advanced tools
A developer friendly dashboard for monitoring your self-hosted services with a clean and modern UI.
First, create an .env
file at the root of the project. Follow the template file at .env.template as an example.
Install dependencies
$ yarn setup
Start development servers
$ yarn start
Install dependencies
$ yarn setup
Build API and UI
$ yarn build
Serve API and UI
$ yarn serve
Note: The API listens on http://localhost:3000 and the UI listens on http://localhost:4000. This is true for both development and production. Feel free to change these in the .env
file.
Build and serve the API and UI
$ docker-compose up -d
# or
$ yarn docker
Rebuild and update the container after code changes
$ docker-compose build --no-cache my-dash
$ docker-compose up -d
# or
$ yarn docker:build
The API fetches data and contains all the credentials to the various services you want to monitor.
API_KEY
This can be anything you want. The key is used by the UI as a form of authentication. Each request to the API contains this key as a parameter.
Upon first load of the UI, you will be prompted to enter this key. It is stored in localStorage
so you don't need to enter it every time. If for some reason you need to update it, just delete the key using your browser's dev tools or by clearing the site data.
If the API rejects the key, the UI will automatically delete the invalid key in localStorage
and ask you to reauthenticate.
UI_ORIGIN
CORS
is also enabled on the API. For local development, this is http://localhost:3000
, unless you changed the port number. For production environments, remember to set the correct origin as http://localhost:3000
is probably not what you want.
The UI fetches data gathered by the API and renders the content. Styling is all handled by Tailwind CSS, head over there to learn more about it.
REACT_APP_API_URL
The URL of your API server. For local development, this is http://localhost:4000
, unless you changed API_PORT
in the .env
file. For production environments, remember to set the correct URL as http://localhost:4000
is probably not what you want.
I recommend you check out the two folders api/src/routes and ui/src/components/services to see how the existing services are implemented.
But as a very brief walk-through:
.env
file.I agree, but we can mitigate the security vulnerability by creating a new admin
with Read Only
access.
Head over to YOUR_UNIFI_URL/manage/site/default/settings/admins/list
and create a new admin with those limited privileges.
https://docs.netdata.cloud/web/api/
https://download.seafile.com/published/web-api/home.md
Login to your Plex application, open up your dev tools and inspect any of the XHR
requests. Look for the parameter X-Plex-Token
.
FAQs
A developer friendly dashboard for monitoring your self-hosted services with a clean and modern UI.
The npm package @kmr/my-dash receives a total of 0 weekly downloads. As such, @kmr/my-dash popularity was classified as not popular.
We found that @kmr/my-dash demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.