
Security News
Another Round of TEA Protocol Spam Floods npm, But It’s Not a Worm
Recent coverage mislabels the latest TEA protocol spam as a worm. Here’s what’s actually happening.
A CLI tool to wrap long-running processes, chop output into segments, and send input to the wrapped process via IPC.
Install globally with pnpm:
pnpm add -g chopup
Or, to use directly with npx:
npx chopup run -- <command-to-wrap> [args...]
run subcommand (default).chopup uses explicit subcommands: run (default), request-logs, and send-input.
run command)This is the default command if no other subcommand is specified.
chopup run [--log-dir <log-dir>] [--socket-path <path>] [--initial-chop] [--watch-file <file-or-dir>] [--send <input>] [--verbose] -- <command-to-wrap> [args...]
# OR (since run is default):
chopup [--log-dir <log-dir>] [--socket-path <path>] [--initial-chop] [--watch-file <file-or-dir>] [--send <input>] [--verbose] -- <command-to-wrap> [args...]
Example:
chopup run -- node my-interactive-app.js
# Or simply:
chopup -- node my-interactive-app.js
--log-dir <path>: Directory to store chopped log files (optional, defaults to $CHOPUP_LOG_DIR or <system_temp_dir>/chopup/logs).--socket-path <path>: Path for the IPC socket file (optional, defaults to <log-dir>/chopup-<pid>.sock).--initial-chop: Perform an initial log chop immediately on startup (optional).--watch-file <file-or-dir>: (EXPERIMENTAL) Watch a file or directory for changes to trigger log chopping (optional).--send <input>: (EXPERIMENTAL) Send an initial input string to the wrapped process after startup (optional).--verbose: Enable verbose logging (optional).--: Separator before the command to wrap.<command-to-wrap> [args...]: The command and arguments to run (e.g., node my-app.js).What happens:
chopup.chopup prints the IPC socket path to stdout:
CHOPUP_SOCKET_PATH=<path-to-socket>
CHOPUP_PROCESS_READY
(Note: The actual socket path is shown in this output. Use it for IPC commands.)chopup commands (see below).Use the request-logs command:
chopup request-logs --socket <socket-path>
Example:
chopup request-logs --socket /tmp/chopup/logs/chopup-12345.sock
--socket <socket-path>: The IPC socket path of the running chopup run instance (from its startup log output).What happens:
chopup run instance via its IPC socket.LOGS_CHOPPED is printed if logs were chopped, or a message if no new logs.CHOPUP_REQUEST_LOGS_ERROR_NO_SERVER or CHOPUP_REQUEST_LOGS_ERROR_UNKNOWN to stderr.Use the send-input command:
chopup send-input --socket <socket-path> --input "<string-to-send>"
Log Suppression Note:
send-input, only the following will be printed to stdout:
CHOPUP_INPUT_SENT (on success)CHOPUP_INPUT_SEND_ERROR, CHOPUP_INPUT_SEND_ERROR_NO_CHILD, or CHOPUP_INPUT_SEND_ERROR_BACKPRESSURE (on failure)CHOPUP_INPUT_SEND_ERROR_NO_SERVER or CHOPUP_SEND_INPUT_ERROR_CONNECTION_FAILED.Example:
Suppose my-interactive-app.js prompts "Are you sure? (y/n): ".
chopup send-input --socket /tmp/chopup/logs/chopup-12345.sock --input "y\n"
--socket <socket-path>: The IPC socket path of the running chopup run instance.--input "<string-to-send>": The string to send to the wrapped process's stdin.
\n in your input string, e.g., "y\n" or "some text then enter\n".What happens:
chopup run instance via IPC.chopup is wrapping.send-input command will print a confirmation (e.g., CHOPUP_INPUT_SENT) or an error message. No other logs will be printed.Start chopup run in one shell with an interactive script:
chopup -- node examples/interactive-script.js
CHOPUP_SOCKET_PATH=... printed on startup.From another shell, send input to the script:
chopup send-input --socket <socket-path> --input "Alice\n"
Observe interactive-script.js in the first shell receiving the input and printing it.
From another shell, trigger a log chop:
chopup request-logs --socket <socket-path>
Check the log directory for segmented log files.
chopup --log-dir ./my-logs -- node examples/interactive-script.js
chopup --send "hello world\n" -- node examples/interactive-script.js
chopup --watch-file ./trigger.txt -- node examples/long-running-script.js
# Touch or modify trigger.txt in another shell to trigger a log chop
chopup --socket-path /tmp/my-custom.sock -- node examples/interactive-script.js
# Use /tmp/my-custom.sock for send-input and request-logs
chopup --verbose -- node examples/interactive-script.js
# See extra [DEBUG] and [DEBUG_SOCKET] logs
chopup --initial-chop -- node examples/long-running-script.js
If you have chopup cloned locally:
Run/Wrap a process:
pnpm start -- run [--log-dir <log-dir>] [--socket-path <path>] [--initial-chop] [--watch-file <file-or-dir>] [--send <input>] [--verbose] -- <command-to-wrap> [args...]
# Or (since run is default):
pnpm start -- [--log-dir <log-dir>] [--socket-path <path>] [--initial-chop] [--watch-file <file-or-dir>] [--send <input>] [--verbose] -- <command-to-wrap> [args...]
Request Logs via IPC:
pnpm start -- request-logs --socket <socket-path>
Send Input via IPC:
pnpm start -- send-input --socket <socket-path> --input "<string-to-send>"
chopup request-logs --socket <path> command.chopup run instance's output (CHOPUP_SOCKET_PATH=...).chopup run instance is still running.send-input.send-input, only CHOPUP_INPUT_SENT, CHOPUP_INPUT_SEND_ERROR, CHOPUP_INPUT_SEND_ERROR_NO_CHILD, or CHOPUP_INPUT_SEND_ERROR_BACKPRESSURE will be printed to stdout. Connection errors will be printed to stderr as CHOPUP_INPUT_SEND_ERROR_NO_SERVER or CHOPUP_SEND_INPUT_ERROR_CONNECTION_FAILED. All other logs are suppressed for this command.chopup run process has not exited before logs could be written.tree-kill or manually clean up.CHOPUP_INPUT_SEND_ERROR_NO_SERVER: Could not connect to the IPC socket (wrong path or process exited).CHOPUP_INPUT_SEND_ERROR: Failed to send input to the child process.CHOPUP_INPUT_SEND_ERROR_NO_CHILD: No child process available to send input.CHOPUP_INPUT_SEND_ERROR_BACKPRESSURE: Child process stdin buffer is full.CHOPUP_REQUEST_LOGS_ERROR_NO_SERVER: Could not connect to the IPC socket for log chopping.CHOPUP_REQUEST_LOGS_ERROR_UNKNOWN: Unknown error during log chopping request.CHOPUP_SEND_INPUT_ERROR_CONNECTION_FAILED: General connection failure for send-input.CHOPUP_SEND_INPUT_ERROR_UNEXPECTED_RESPONSE: Unexpected response from server.CHOPUP_SEND_INPUT_ERROR_SERVER_PARSE: Server could not parse the IPC message.CHOPUP_SEND_INPUT_ERROR_UNEXPECTED_CLOSE: IPC connection closed unexpectedly.pnpm formatpnpm lintpnpm testpnpm build (creates dist/index.js)All example scripts referenced above are in the examples/ directory:
examples/interactive-script.js: Simple script that prints input it receives.examples/long-running-script.js: Script that logs periodically.To verify the CLI and README examples:
chopup example (see above).chopup send-input or chopup request-logs as shown.A helper script examples/verify-examples.sh is provided to automate these checks for CI or local verification.
ISC
main trigger semantic-release:
NPM_TOKEN secret in repo settings.pnpm run release --dry-run
NPM_TOKEN in GitHub repo secrets for publish to work.publishConfig.access is set to public in package.json.FAQs
A tool to wrap long-running processes and chop their logs based on file changes.
The npm package chopup receives a total of 1 weekly downloads. As such, chopup popularity was classified as not popular.
We found that chopup demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Recent coverage mislabels the latest TEA protocol spam as a worm. Here’s what’s actually happening.

Security News
PyPI adds Trusted Publishing support for GitLab Self-Managed as adoption reaches 25% of uploads

Research
/Security News
A malicious Chrome extension posing as an Ethereum wallet steals seed phrases by encoding them into Sui transactions, enabling full wallet takeover.