Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
child_process
Advanced tools
This package name is not currently in use, but was formerly occupied by another package. To avoid malicious use, npm is hanging on to the package name, but loosely, and we'll probably give it to you if you want it.
The 'child_process' module in Node.js allows you to spawn new processes, execute commands, and communicate with those processes. It provides a way to run shell commands, scripts, and other programs from within a Node.js application.
Spawning a new process
The 'spawn' function launches a new process with a given command. In this example, it runs the 'ls' command with the '-lh' and '/usr' arguments. The stdout and stderr streams are used to handle the output and errors, respectively.
const { spawn } = require('child_process');
const ls = spawn('ls', ['-lh', '/usr']);
ls.stdout.on('data', (data) => {
console.log(`stdout: ${data}`);
});
ls.stderr.on('data', (data) => {
console.error(`stderr: ${data}`);
});
ls.on('close', (code) => {
console.log(`child process exited with code ${code}`);
});
Executing a command
The 'exec' function runs a command in a shell and buffers the output. This example executes the 'ls -lh /usr' command and logs the stdout and stderr outputs. If an error occurs, it is logged as well.
const { exec } = require('child_process');
exec('ls -lh /usr', (error, stdout, stderr) => {
if (error) {
console.error(`exec error: ${error}`);
return;
}
console.log(`stdout: ${stdout}`);
console.error(`stderr: ${stderr}`);
});
Forking a new Node.js process
The 'fork' function is a special case of 'spawn' used to create new Node.js processes. It allows for communication between the parent and child processes using the 'message' event. In this example, a new Node.js process is created to run 'child.js', and messages are exchanged between the parent and child.
const { fork } = require('child_process');
const child = fork('child.js');
child.on('message', (msg) => {
console.log('Message from child', msg);
});
child.send({ hello: 'world' });
Execa is a modern alternative to 'child_process'. It provides a more user-friendly API for executing shell commands and handling their output. Execa supports promises, better error handling, and more features compared to the standard 'child_process' module.
Cross-spawn is a package that provides a consistent API for spawning child processes across different platforms. It addresses issues with the default 'child_process' module, especially on Windows, making it easier to write cross-platform code.
ShellJS is a portable (Windows/Linux/OS X) implementation of Unix shell commands on top of the Node.js API. It provides a higher-level API for executing shell commands and scripts, making it easier to work with the filesystem and other shell tasks.
This package name is not currently in use, but was formerly occupied by another package. To avoid malicious use, npm is hanging on to the package name, but loosely, and we'll probably give it to you if you want it.
You may adopt this package by contacting support@npmjs.com and requesting the name.
FAQs
This package name is not currently in use, but was formerly occupied by another package. To avoid malicious use, npm is hanging on to the package name, but loosely, and we'll probably give it to you if you want it.
The npm package child_process receives a total of 720,864 weekly downloads. As such, child_process popularity was classified as popular.
We found that child_process demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.