Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
angry-caching-proxy
Advanced tools
Angry Caching Proxy which speeds up package downloads for apt-get, npm and rubygems
Make package downloads lightning fast for apt-get, npm, pip and Rubygems!
Angry Caching Proxy is forwarding proxy for various package managers. It is
configured transparently to the clients using the http_proxy
environment
variable. So there is no need to have customized sources.list, Gemfile etc.
It works by doing very angry caching (forever!) for the actual package files. This should be ok as long as the package authors won't override already uploaded packages. It is a very bad practice by the package authors and happens very rarely. If it happens anyway you can always clear the cache from the web interface of Angry Caching Proxy.
Installing or upgrading multiple Ubuntu machines. In the worst case you have to download gigabytes of .deb packages for each machine. With Angry Caching Proxy the packages are downloaded once and then served instantly from the cache.
When doing distributed builds it might be hard to share local disk caches.
Just speeding up your local bundle install
runs.
Get node.js and type
sudo npm install -g angry-caching-proxy
or if you don't like sudoing random code you can install it locally too:
npm install angry-caching-proxy
and execute it with
node_modules/.bin/angry-caching-proxy
Create /etc/angry-caching-proxy/config.json
with any of the following keys:
directory
: Where to store cached requests.port
: Port to listen.
workes
: Workers to use. Default to machine cpu core count.customTriggers
: Path to custom triggers module.
triggers
: Array of triggers to activate.
["apt-get", "npm", "pypi", "rubygems"]
If you want to add additional caching you can create
/etc/angry-caching-proxy/triggers.js
file with your own caching functions.
It should export an object of functions that return true
when the request
should be cached. The caching occurs only if the upstream responds with http
success status 200. Only GET requests can be cached.
Example:
module.exports = {
"custom": function isMyCustomCacheRequest(req, res) {
// Cache all requests that contain X-My-Cache header
return req.headers["X-My-Cache"]);
},
};
See buildin-triggers.js for examples.
New build-in triggers are also welcome as a pull request.
Create directory where to save cached requests
mkdir cache
and start the server
angry-caching-proxy --directory cache
You can inspect and clear the cache by browsing directly to the proxy address http://localhost:8080
http_proxy=http://localhost:8080 sudo -E apt-get install sl
http_proxy=http://localhost:8080 bundle install
With npm it is required to use the non-https version of the registry
http_proxy=http://localhost:8080 npm install --registry http://registry.npmjs.org/
http_proxy=http://localhost:8080 pip install plone
Cool guys can also set the proxy globally for everybody:
export http_proxy=http://localhost:8080
FAQs
Angry Caching Proxy which speeds up package downloads for apt-get, npm and rubygems
The npm package angry-caching-proxy receives a total of 1 weekly downloads. As such, angry-caching-proxy popularity was classified as not popular.
We found that angry-caching-proxy demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.