
Research
Security News
Lazarus Strikes npm Again with New Wave of Malicious Packages
The Socket Research Team has discovered six new malicious npm packages linked to North Korea’s Lazarus Group, designed to steal credentials and deploy backdoors.
Remote execution with VPC support, kinda like fabric/capistrano for node with greater scripting control via generators.
$ npm install cloud
Usage: cloud <task ...>
Options:
-h, --help output usage information
-D, --dry-run perform a dry run
-t, --tasks output list of available tasks
-H, --hosts output list of available hosts
-v, --verbose output verbose log information
-c, --concurrency <n> task execution concurrency [1]
When cloud.parse(argv)
is run it turns your script into
a CLI, so flags such as --help
and --tasks
are available,
and arguments may be passed to execute tasks.
Here's a contrived example that runs hostname
on private hosts
in a VPC:
var Cloud = require('cloud');
var c = new Cloud;
var stage = c.host('stage', {
key: '~/.ec2/my.pem',
user: 'ec2-user',
address: 'n.n.n.n'
});
c.task('stage', 'stage everything', ['stage:site', 'stage:api', 'stage:ingestion']);
c.task('stage:site', 'stage site', function *(){
console.log(yield stage.exec('hostname'));
});
c.task('stage:api', 'stage api', function *(){
console.log(yield stage.exec('hostname', 'api'));
});
c.task('stage:ingestion', 'stage ingestion', function *(){
console.log(yield stage.exec('hostname', 'ingestion'));
});
c.parse(process.argv);
To list tasks use the -t, --tasks
flag:
node --harmony cloud -t
stage — stage everything
stage:site — stage site
stage:api — stage api
stage:ingestion — stage ingestion
Executing remote commands is simple, just execute host.exec(command)
, optionally
passing a private hostname to execute on a private host:
var uptime = yield stage.exec('uptime');
var uptime = yield stage.exec('uptime', 'api-1');
var uptime = yield stage.exec('uptime', 'api-2');
var uptime = yield stage.exec('uptime', 'api-3');
If you're running many commands on a private host, you may want
to create a new Host
object to reference it, for example the
following are equivalent:
var a = yield stage.exec('foo', 'api-1');
var b = yield stage.exec('bar', 'api-1');
var c = yield stage.exec('baz', 'api-1');
var api = stage.host('api-1');
var a = yield api.exec('foo');
var b = yield api.exec('bar');
var c = yield api.exec('baz');
Since cloud uses Co you may also execute in parallel:
var res = yield [
stage.exec('uptime', 'api-1'),
stage.exec('uptime', 'api-2')
];
var uptime1 = res[0];
var uptime2 = res[1];
Or assign to an object:
var uptimes = {
api1: stage.exec('uptime', 'api-1'),
api2: stage.exec('uptime', 'api-2')
};
To execute shell scripts from local disk use the host.run(script)
method:
yield stage.run('provision.sh');
You may also specify a private host just like host.exec()
:
yield stage.run('provision.sh', 'api-1');
yield stage.run('provision.sh', 'api-2');
yield stage.run('provision.sh', 'api-3');
One method of defining dependencies is by passing an array as shown in the following example:
c.task('stage', 'stage everything', ['stage:site', 'stage:api', 'stage:ingestion']);
You may also utilize c.task(name)
to execute programmatically:
c.task('stage', 'stage everything', function *(){
yield c.task('stage:api');
yield c.task('stage:site');
yield c.task('stage:ingestion');
});
This gives you greater control over flow and concurrency, for example the last two will run in parallel:
c.task('stage', 'stage everything', function *(){
yield c.task('stage:site');
yield [
c.task('stage:api'),
c.task('stage:ingestion'),
];
});
The this
variable becomes a Context
which holds all of the values
defined via the -s, --set
flag. For example -s version=1.2.0
will
provide this.version == "1.2.0"
, and -s debug
will set this.debug == true
.
You may also omit the -s
flag entirely when a value is supplied, for example
the follow would be equivalent.
$ mycommand site:run -s cmd=uptime
$ mycommand site:run cmd=uptime
MIT
FAQs
Control cloud with command line
The npm package cloud receives a total of 63 weekly downloads. As such, cloud popularity was classified as not popular.
We found that cloud demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
The Socket Research Team has discovered six new malicious npm packages linked to North Korea’s Lazarus Group, designed to steal credentials and deploy backdoors.
Security News
Socket CEO Feross Aboukhadijeh discusses the open web, open source security, and how Socket tackles software supply chain attacks on The Pair Program podcast.
Security News
Opengrep continues building momentum with the alpha release of its Playground tool, demonstrating the project's rapid evolution just two months after its initial launch.