Research
Security News
Quasar RAT Disguised as an npm Package for Detecting Vulnerabilities in Ethereum Smart Contracts
Socket researchers uncover a malicious npm package posing as a tool for detecting vulnerabilities in Etherium smart contracts.
Node.js child_process
done remotely, IPC channel intact!
Example:
var cp_remote = require('cp-remote');
var assert = require('assert');
var remote = cp_remote.run('host', '/path/on/host/to/sub.js', 'foo', { answer: 42 });
remote.on('message', function (msg)
{
assert.deepEqual(msg, { foo: 'bar' });
});
remote.send({ hello: 'world' });
You might implement the remote script, sub.js
, like this:
var assert = require('assert');
assert.equal(process.argv[2], 'foo')
assert.deepEqual(process.argv[3], { answer: 42 });
process.on('message', function (msg)
{
assert.deepEqual(msg, { hello: 'world' });
process.disconnect();
});
process.send({ foo: 'bar' });
The API is described here.
Client:
Remote host:
node
command should be in the remote PATH
of SSH sessions)socketpair
, Node does not)npm install cp-remote
You can't pass handles to a remote child process like you can with local child processes.
cp-remote
calls child_process.spawn
to run a Bash script, cp-remote.sh
. The IPC channel will be on $NODE_CHANNEL_FD
.cp-remote.sh
runs socat
, telling it to relay data between $NODE_CHANNEL_FD
and an SSH connection to the remote host.cp-remote.py
on the remote host.cp-remote.py
calls socket.socketpair
to create a pair of connected file descriptors (Unix domain sockets).cp-remote.py
starts socat
, telling it to relay data between standard input (i.e. the SSH connection) and one of the connected file descriptors.cp-remote.py
sets NODE_CHANNEL_FD
to the other connected file descriptor and starts node
, telling it to run the module you specified.To test creating and communicating with remote child processes:
grunt test --remote=<host1> --remote=<host2> ...
You can specify as many remote hosts as you like. The test will try to create a remote child process on each host and then communicate with each one.
It assumes the cp-remote
module is installed at the same path on each host.
grunt lint
grunt coverage --remote=<host1> --remote=<host2> ...
c8 results are available here.
Coveralls page is here.
Source: index.js
Run a Node.js module on a remote host and return a
child_process.ChildProcess
object for communication with it.
Parameters:
{String} host
The name (or IP address) of the remote host to run the module on.{String} module_path
The path to the module on the remote host. Any arguments following module_path
will be made available to the module in its process.argv
(starting at the third element).Return:
{child_process.ChildProcess}
The ChildProcess
object for the remote process. You can do the same things with this object as a local ChildProcess
, except send it handles (i.e. the optional sendHandle
parameter to child.send
isn't supported).
Go: TOC
—generated by apidox—
FAQs
Remote child_process runner with message support
The npm package cp-remote receives a total of 27 weekly downloads. As such, cp-remote popularity was classified as not popular.
We found that cp-remote demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket researchers uncover a malicious npm package posing as a tool for detecting vulnerabilities in Etherium smart contracts.
Security News
Research
A supply chain attack on Rspack's npm packages injected cryptomining malware, potentially impacting thousands of developers.
Research
Security News
Socket researchers discovered a malware campaign on npm delivering the Skuld infostealer via typosquatted packages, exposing sensitive data.