
Security Fundamentals
Turtles, Clams, and Cyber Threat Actors: Shell Usage
The Socket Threat Research Team uncovers how threat actors weaponize shell techniques across npm, PyPI, and Go ecosystems to maintain persistence and exfiltrate data.
Tracks async hook events related to network operations.
npm install ah-net
Instantiates a NetworkActivityCollector.
Most of the actual processing of resources is performed by th @see NetworkResourceProcessor.
Extends ActivityCollector and thus exposes the same public API with added functionality.
Parameters
$0.start
Array<number> the start time of the process, i.e. the result of process.hrtime()
$0.stackCapturer
StackCapturer? see ah-stack-capturer which
configures how and when stacks traces are captured and processed.By default a StackCapturer is used that captures stacks for all events for
file system related types: FSREQWRAP
, FSREQUESTWRAP
and some others like
TickObject
s that also are related, i.e. if they contain information related
to streams. (optional, default StackCapturer
)$0.bufferLength
number? determines how many elements of Buffers are
captured. By default not Buffer data is captured. (optional, default 0
)$0.stringLength
number? determines how much of each string is
captured. By default no string data is captured. (optional, default 0
)$0.captureArguments
boolean? if true
arguments of callbacks
are captured when they are processed. (optional, default false
)$0.captureSource
boolean? if true
the source code of callbacks
is captured when they are processed. (optional, default false
)Extends ResourceProcessor
The Network processor grabs information off the network socket itself, the server if present.
In the case of an http request the HTTPPARSR resource is present. It has a lot of useful properties attached to it, including incoming and outgoing http messages.
Below is a condensed outline of the HTTPARSER properties that are most relevant:
{
socket: {
_httpMessage {
_header
, statusMessage
, statusCode
, _headerSent
, finished
...
}
, _handle: { fd, reading, _parent }
, server: { _connectionKey }
}
, incoming {
httpVersion*
, headers: { host, connection }
, upgrade
, url
, method
, statusCode
, statusMessage
}
}
MIT
FAQs
Tracks async hook events related to network operations.
The npm package ah-net receives a total of 0 weekly downloads. As such, ah-net popularity was classified as not popular.
We found that ah-net demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security Fundamentals
The Socket Threat Research Team uncovers how threat actors weaponize shell techniques across npm, PyPI, and Go ecosystems to maintain persistence and exfiltrate data.
Security News
At VulnCon 2025, NIST scrapped its NVD consortium plans, admitted it can't keep up with CVEs, and outlined automation efforts amid a mounting backlog.
Product
We redesigned our GitHub PR comments to deliver clear, actionable security insights without adding noise to your workflow.