
Research
NPM targeted by malware campaign mimicking familiar library names
Socket uncovered npm malware campaign mimicking popular Node.js libraries and packages from other ecosystems; packages steal data and execute remote code.
@socialgorithm/uatc
Advanced tools
This is a small test package for testing the socialgorithm platform.
This is the quickest way to get started:
npx @socialgorithm/uatc help
To install and run this util clone this repo and:
npm i
npm run build
node ./dist/uatc.js help
This expects that @socialgorithm/uabc is installed globally.
You will also need a player(s) that is ready to connect and play games.
uatc init
- Spits out a scaffolding config file.
uatc play
- Play a tournament.
uatc start-servers
- Starts the game servers.
uatc stop-servers
- Stops the game servers.
uatc validate-servers
- Prints the status of the game servers
This package is configured via a uatc.js
file in the directory your running the command.
The best way to create this is to run uatc init
which will give you the basic scaffolding.
Config:
{
playTournament: { // The config for the play mode.
players: [ // A collection of players to run against the game
{
command: 'node example.js', // The command to run to start this player. See uabc file arg
number: 5, // The number of players of this type to connect
name: 'example' // The name to use when connecting to the game
}
],
tournamentServerAddress: 'http://localhost:3141',
autoplay: true,
tournamentSettings: { // Settings to use when playing the tournament
timeout: 100,
numberOfGames: 50,
type: "DoubleElimination",
autoPlay: false
}
},
servers: { // config for the servers
tournament: {
location: '../tournament-server', // relative location of the server. Must be npm installed and built
startupCommand: 'node ./dist/index.js', // ensure this command starts the server rather than runs a script that spawns it like an npm command
expectedPort: 3141 // where it is expected to be once started. Used for validation
},
game: {
location: '../tic-tac-toe-game-server',
startupCommand: 'node ./dist/index.js',
expectedPort: 5433
}
}
}
FAQs
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Socket uncovered npm malware campaign mimicking popular Node.js libraries and packages from other ecosystems; packages steal data and execute remote code.
Research
Socket's research uncovers three dangerous Go modules that contain obfuscated disk-wiping malware, threatening complete data loss.
Research
Socket uncovers malicious packages on PyPI using Gmail's SMTP protocol for command and control (C2) to exfiltrate data and execute commands.