Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Ever wanted to do a one-off scrape of a web page? Tired of writing scraping boilerplate for applications and wish you had a nice UNIX-style command to call to do it for you? Enter clidom!
npm install -g clidom
clidom selector [URL] [options]
selector[::subselector]
clidom extends selector syntax to allow you to not only select elements, but mutate the elements as needed. clidom provides the following syntax for subselectors:
innerHtml
- Returns the element's inner HTML (default)outerHtml
- Returns the element's outer HTMLtext
- Returns the text inside the element, stripping tags[attribute]
- Returns the value of the specified attribute-o, --out-file File to write JSON output [default: '-' (stdout)]
-p, --pretty Pretty JSON output [default: true]
-t, --trim Trim empty results [default: true]
-h, --help Show help
Output a pretty JSON object of button labels on http://www.google.com:
clidom input[type="submit"]::[value] https://www.google.com
Output:
{
"input[type=submit]::[value]": [
{
"value": "Google Search"
},
{
"value": "I'm Feeling Lucky"
}
]
}
Output a pretty JSON object of Twitter usernames talking about node.js:
clidom 'span.username b' 'https://twitter.com/search?f=realtime&q=node.js'
Output: (will vary over time)
{
"span.username b": [
"hashedrock",
"mashupaward",
"orangesuzuki",
"RJ_Hsiao",
"mongodbExpert",
"JanilsonPy",
"npm_tweets",
"nodenpm",
"npm_tweets",
"StrongLoop",
"DevelopersDojo",
"adstweetbot",
"Johnny_Rehab",
"jramonleon",
"questionjs",
"AsadNomanMS",
"amit_intelli",
"rekkuuzadx",
"npm_tweets",
"adstweetbot"
]
}
You can of course use this with any other UNIX application, for instance if we wanted to remove all the wrapping JSON, we could do this:
clidom 'span.username b' 'https://twitter.com/search?f=realtime&q=node.js' | jq '.[] | .[]' | tr -d \"
We'd simply get the strings of the users, e.g.:
hashedrock
mashupaward
orangesuzuki
RJ_Hsiao
mongodbExpert
JanilsonPy
npm_tweets
nodenpm
npm_tweets
StrongLoop
DevelopersDojo
adstweetbot
Johnny_Rehab
jramonleon
questionjs
AsadNomanMS
amit_intelli
rekkuuzadx
npm_tweets
adstweetbot
FAQs
Parse a DOM from the command line
The npm package clidom receives a total of 0 weekly downloads. As such, clidom popularity was classified as not popular.
We found that clidom demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.