Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Another logger, but this one is aimed at devs. Not for production but for a simple daily developer life.
Under development - not usable
This is under development and is likely to change Instal globally
npm install -g cutwood
Then pipe into it
ping www.rankida.com | cutwood
by default it will just echo what you give it, but more coming soon!
A very simple configuration currently under the profile name of "server"
will strip out any ops logging (like you can get from a hapijs server) and will also colour red any logs with the word error in it.
node ./test/fixtures/server.js | cutwood --profile server
This uses a simple test script in server.js
to generate some logs. Run it without cutwood to see what the original looks like.
There are a few stages
Input: _Get the logs_
`-> stdout
`-> single log file
`-> single folder with log files
`-> single folder with many sub-folders with logs somewhere in and about there
Parsing: _Turn log lines into objects_
`-> For now simple transform of one log line to one object
`-> In the future there could be places where multiple log lines make up an object eg stack traces
`-> string splits, regexes, JSON parsing etc
Filtering: _Throw it away_
`-> exclude an entry permanently from progressing
`-> regex or simple javascript func
`-> could come before and after parsing
Output format: _Send it to where it needs to go_
`-> For consoles that will be pretty printing etc
`-> conditions should be placed on it because some lines may be just raw log, others might be pretty formats
`-> For search indexes we might need to prepare the object with what is searchable/keywords/untokenized etc
through
- https://github.com/dominictarr/throughtransform-stream
- https://github.com/Raynos/transform-streamcutwoood
.stdin()
.remove()
.transform(//)
FAQs
Yet another logger
We found that cutwood demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.