Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Datagram forwarding behind NAT
Anygram uses STUN to get the mapped address, IRC to signal peers.
npm -g install anygram@latest
anygram -n [serverNick] -m server -P [serverPort]
anygram -n [clientNick] -m client -s [serverNick] -p [clientPort] -P
[serverPort]
The commands above will forward packets to 127.0.0.1:clientPort
@client
to 127.0.0.1:serverPort
@server. For more options, see anygram --help
To run the commands forever, consider using forever
var anygram = require('anygram')(config);
The config options is also listed in anygram --help
In AnyGram, all sockets are UDP sockets.
Returns a promise of socket. socket.rinfo
may change if the remote NAT
is symmetric. The punching process usually succeeds if not both NATs are
symmetric.
socket
is a UDP socket plus two attributes linfo
and rinfo
,
obtained by calling anygram.stun
The rinfo.punchTime
attribute also indicates when to start punching.
This option is to make sure both sides start punching at the same time
in spite of
the (sometimes huge) IRC time lag.
Returns a promise of socket. socket.linfo
will include the mapped
port
, address
and the NAT type
.
stunServer
is the hostname of a stun server listening at 3478
Returns an IRC client.
The config should specify the name
and pass
(if any) of your IRC
account. The IRC server's host
and port
are optional. The client
will send PING packets at the keepalive
interval.
Returns a promise of socket.
irc
is the IRC client
to
is the name of the peer you are connecting to
rinfo
(optional) is specified if you already got peer's rinfo
Start listening on the irc
client for incoming connections
onconn
is called when connected with a peer successfully
onerr
is called on error
Sends msg
with 4 bytes header (lport
and rport
)
Parses received messages to cb(msg
, lport
, rport
)
Notice that the rport
@remote will become lport
@local and vice versa.
FAQs
Datagram forwarding behind NAT
The npm package anygram receives a total of 0 weekly downloads. As such, anygram popularity was classified as not popular.
We found that anygram demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.