
Research
Security News
Lazarus Strikes npm Again with New Wave of Malicious Packages
The Socket Research Team has discovered six new malicious npm packages linked to North Korea’s Lazarus Group, designed to steal credentials and deploy backdoors.
An express-based http helper lib.
Ripped from the guts of Anvil.
Simple navigate to /_autohost to review the current set of resources:
var host = require( 'autohost' )();
host.init();
Configuration can be provided optionally to the init call or during instantiation after the require. The object literal follows the format:
{
processes: 1, // # of processes to spawn - not currently in use
static: './public', // where to host static resources from, default value shown
resources: './resource', // where to load resource modules from, default value shown
port: 8800, // what port to host at, default shown
allowedOrigin: 'leankit.com', // used to filter incoming web socket connections based on origin
websockets: true // enables websockets
}
Resources are expected to be simple modules that return a parameterless function resulting in a JS literal that follows the format:
{
name: 'resource-name',
resources: '', // relative path to static assets for this resource
actions: [
{
alias: 'send', // not presently utilized
verb: 'get', // http verb
topic: 'send', // topic segment appended the resource name
path: '', // url pattern appended to the resource name
handle: function( envelope ) {
// envelope.data, envelope.headers and envelope.params may contain
// information about the request/message received
// envelope reply takes a object literal with data property for
// http body|websocket message
}
}
]
}
Lots of methods are available but not generally intended for use outside the library. Other than init, there are two methods for interacting with connected websocket clients.
MIT License - http://opensource.org/licenses/MIT
FAQs
Resource driven, transport agnostic host
The npm package autohost receives a total of 114 weekly downloads. As such, autohost popularity was classified as not popular.
We found that autohost demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 4 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
The Socket Research Team has discovered six new malicious npm packages linked to North Korea’s Lazarus Group, designed to steal credentials and deploy backdoors.
Security News
Socket CEO Feross Aboukhadijeh discusses the open web, open source security, and how Socket tackles software supply chain attacks on The Pair Program podcast.
Security News
Opengrep continues building momentum with the alpha release of its Playground tool, demonstrating the project's rapid evolution just two months after its initial launch.