Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
@socket.io/admin-ui
Advanced tools
First, install the @socket.io/admin-ui
package:
npm i @socket.io/admin-ui
And then invoke the instrument
method on your Socket.IO server:
const { createServer } = require("http");
const { Server } = require("socket.io");
const { instrument } = require("@socket.io/admin-ui");
const httpServer = createServer();
const io = new Server(httpServer, {
cors: {
origin: ["https://admin.socket.io"]
}
});
instrument(io, {
auth: false
});
httpServer.listen(3000);
The module is compatible with:
You can then head up to https://admin.socket.io, or host the files found in the ui/dist
folder.
Important note: the website at https://admin.socket.io is totally static (hosted on Vercel), we do not (and will never) store any information about yourself or your browser (no tracking, no analytics, ...). That being said, hosting the files yourself is totally fine.
You should see the following modal:
Please enter the URL of your server, including the namespace (for example, http://localhost:3000/admin
or https://example.com/admin
) and the credentials, if applicable (see the auth
option below).
auth
Default value: -
This option is mandatory. You can either disable authentication (please use with caution):
instrument(io, {
auth: false
});
Or use basic authentication:
instrument(io, {
auth: {
type: "basic",
username: "admin",
password: "$2b$10$heqvAkYMez.Va6Et2uXInOnkCT6/uQj1brkrbyG3LpopDklcq7ZOS" // "changeit" encrypted with bcrypt
},
});
namespaceName
Default value: /admin
The name of the namespace which will be created to handle the administrative tasks.
instrument(io, {
namespaceName: "custom"
});
This namespace is a classic Socket.IO namespace, you can access it with:
const adminNamespace = io.of("/admin");
More information here.
readonly
Default value: false
Whether to put the admin UI in read-only mode (no join, leave or disconnect allowed).
instrument(io, {
readonly: true
});
serverId
Default value: require("os").hostname()
The ID of the given server. If you have several Socket.IO servers on the same machine, please give them a distinct ID:
instrument(io, {
serverId: `${require("os").hostname()}#${process.pid}`
});
store
Default value: new InMemoryStore()
The store is used to store the session IDs so the user do not have to retype the credentials upon reconnection.
If you use basic authentication in a multi-server setup, you should provide a custom store:
const { instrument, RedisStore } = require("@socket.io/admin-ui");
instrument(io, {
store: new RedisStore(redisClient)
});
You can check the details of the implementation in the lib/index.ts file.
The instrument
method simply:
connection
and disconnect
event for each existing namespaces to track socket instancesjoin
, leave
and _disconnect
commands sent from the UIMIT
FAQs
Admin UI for Socket.IO
The npm package @socket.io/admin-ui receives a total of 19,352 weekly downloads. As such, @socket.io/admin-ui popularity was classified as popular.
We found that @socket.io/admin-ui demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.