
Research
Malicious npm Packages Impersonate Flashbots SDKs, Targeting Ethereum Wallet Credentials
Four npm packages disguised as cryptographic tools steal developer credentials and send them to attacker-controlled Telegram infrastructure.
anon will watch Wikipedia for anonymous edits from a set of named IP ranges and will tweet when it notices one. It was inspired by @parliamentedits and was used to make @congressedits available until the account was suspended by Twitter in 2018. An archive of the @congressedits tweets up until that point is available. For more about why the @congressedits accounts was suspended see this article from The Wikipedian. anon is now being used by a community of users to post selected Wikipedia edits to Twitter.
anon can also send updates on GNU Social / Mastodon (see below)
To run anon you will need to:
git clone https://github.com/edsu/anon.git
cd anon
npm install
cp config.json.template config.json
config.json
(make sure the Twitter
app you create has read/write permission so it can tweet)config.json
You will notice in the example config.json.template
that you can configure
ip address ranges using a netmask:
"143.231.0.0/16"
or with an array of start/end IP addresses:
["143.231.0.0", "143.231.255.255"]
These two are equivalent, but the former is a bit faster, and easier to read. The latter is convenient if your range is difficult to express using a netmask.
If you would like your configuration file to reference the IP addresses in the external file just use the filename. So instead of:
{
"nick": "anon1234",
"accounts": [
{
"consumer_key": "",
"consumer_secret": "",
"access_token": "",
"access_token_secret": "",
"template": "{{page}} Wikipedia article edited anonymously from {{name}} {{&url}}",
"ranges": {
"Home Network": [
["192.168.1.1", "192.168.255.255"]
]
}
}
]
}
you would have:
{
"nick": "anon1234",
"accounts": [
{
"consumer_key": "",
"consumer_secret": "",
"access_token": "",
"access_token_secret": "",
"template": "{{page}} Wikipedia article edited anonymously from {{name}} {{&url}}",
"ranges": "ranges.json"
}
]
}
If you want to send messages on Mastodon you'll need to create an application and then get an access token for the account you want to send on. A utility is included to help you do that:
npm run mastodon
If you would like to test without tweeting you can run anon with the
--noop
flag, which will cause the tweet to be written to the console
but not actually sent to Twitter.
./anon.js --noop
If you would like to see all the change activity (URLs for each change) to test
that it is actually listening, use the --verbose
flag:
./anon.js --verbose
By default anon will look for a config.json
file in your current working
directory. If you would like to specify the location of the configuration
file, use the --config
parameter:
./anon.js --config test.config
cd anon
docker build . -t anon
config.json
filedocker run -v $PWD/config.json:/opt/anon/config.json anon
There is not much to anon but there is a small test suite, which might come in handy if you want to add functionality.
npm test
anon uses the wikichanges module to listen to 38 language Wikipedias. wikichanges achieves this by logging in to the Wikimedia IRC server and listening to the recent changes channels for each Wikipedia. So if you plan on running wikichanges be sure your network supports IRC (it can sometimes be blocked).
Here are the Wikipedias that it currently supports:
Additionally, the following miscellaneous Wikimedia sites:
If you would like to have another one added please add a ticket to the wikichanges issue tracker.
Below is a list of known anon instances. Please feel free to add, in an alphabetic order, your own by sending a pull request.
FAQs
Tweet anonymous edits to Wikipedia from IP ranges.
We found that anon demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Four npm packages disguised as cryptographic tools steal developer credentials and send them to attacker-controlled Telegram infrastructure.
Security News
Ruby maintainers from Bundler and rbenv teams are building rv to bring Python uv's speed and unified tooling approach to Ruby development.
Security News
Following last week’s supply chain attack, Nx published findings on the GitHub Actions exploit and moved npm publishing to Trusted Publishers.