
Research
/Security News
Critical Vulnerability in NestJS Devtools: Localhost RCE via Sandbox Escape
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
The giant then reached out the hands in haste Whose mighty grip was felt by Hercules And took my guide. Feeling himself embraced, Virgil looked down and said: "Come closer, please: It's your turn." Inferno, Canto 31
Antaeus is a node webserver that wraps the IPFS daemon. It allows you to define a mapping from a hostname to an IPFS address, so that you can serve a website from IPFS on a root domain name.
Antaeus requires the ipfs client and daemon to be installed and running. It is packaged as an npm module:
$ npm install -g antaeus
This will install a command line program antaeus
that can be used to start the webserver:
$ antaeus start --port 8080 --dnsConfig dnsMapping.json
The dns mapping file is a json map from hostnames to ipfs addresses:
{
"www.example.com": "/ipfs/QmWATWQ7fVPP2EFGu71UkfnqhYXDYH566qy47CnJDgvs8u"
}
Once started, you will need to modify your hosts file to test the mapping in the browser.
You can test with curl
more directly by setting the appropriate hostname:
$ curl -H 'Host: www.example.com' localhost:8080 # Hello World
The dns mapping file can be loaded from ipfs itself. The dnsConfig
option accepts an ipfs address:
$ ipfs add dnsMapping.json
added QmeUrP9wiBxBv9GA7D22F8n5gNok4uMmBeZWkarmAwBJHD dnsMapping.json
$ antaeus start --port 8080 --dnsConfig QmeUrP9wiBxBv9GA7D22F8n5gNok4uMmBeZWkarmAwBJHD
The main entry point is src/index.js
, so to start the server for development run:
$ nodemon src/index test/exampleDNSConfig.json
To run the tests:
$ npm test
To lint the code:
$ npm run lint
To get the test coverage:
$ npm run coverage
MIT
FAQs
IPFS gateway
The npm package antaeus receives a total of 0 weekly downloads. As such, antaeus popularity was classified as not popular.
We found that antaeus demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
Product
Customize license detection with Socket’s new license overlays: gain control, reduce noise, and handle edge cases with precision.
Product
Socket now supports Rust and Cargo, offering package search for all users and experimental SBOM generation for enterprise projects.