Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Tunneling Anywhere (Behind NAT)
You'll need a LeanCloud account (free). Its realtime messaging service is used during the UDP hole punching process.
npm -g install anytunnel
anytunnel \
-r [leancloud region] \
-a [leancloud appId] \
-s [serverId] \
-L kcp://localhost:[port1]
anytunnel \
-c \
-r [leancloud region] \
-a [leancloud appId] \
-s [serverId] \
-F kcp://localhost:[port2] \
-L socks://localhost:[port3]
The commands above will setup a socks5 proxy listening at port3
on the
client, forwarding packets to the server.
The serverId
, port1
, port2
options are arbitrary. Also, you can
specify any -F / -L options accepted by
gost as long as there is
AnyTunnel forwards UDP packets according to these two options.
gost (GO Simple Tunnel) provides proxy functions, especially KCP over UDP tunneling.
LeanCloud provides realtime signaling service.
stun for stun packets parsing, the result is then signaled to peers.
exit-hook for on-exit cleanup (killing the gost child process)
commander for command line options parsing
FAQs
(deprecated) consider using anygram instead
The npm package anytunnel receives a total of 0 weekly downloads. As such, anytunnel popularity was classified as not popular.
We found that anytunnel demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.