Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
You have a lot of alternatives (requirejs, AMD), but to get started quickly you can use commonjseverywhere.
cjsify defenders.js --no-node --export defenders --source-map defenders.browser.js.map >defenders.browser.js
Example of sort code validation in different guises using defender
The Soothsayer is interlinked to the Fortune teller, but the basic idea is that you create a Soothsayer and give it a pattern that can be parsed and replaced by other things (RegExp, DOM elements).
The Soothsayer is not restricted by the bounds of the validator, just what you pass in for the look up of the pattern. If nothing is found an error is thrown.
To help with this we have Runes, which make it easier to work with Regular Expressions.
The following example creates a Soothsayer and generates a possible future of regular expressions.
var pattern = IO(function() {
return '##-##-##';
});
var sayer = soothsayer({
'#': /^[0-9]/,
'-': /^-/
})(pattern);
The Guardians job in the flow is to remove any items from the input that you don't want to be validated by the Defender. In turn guarding the Defender.
It's a simple premise of using a regular expression to attempt to normalise the user input as much as possible, such as trimming the white space front and back or removing comments.
The following example creates a Guardian which will guard against white space.
var guard = guardian(/^\s/);
The Defenders job is go through the Soothsayers runes and check the input against those runes. The result is either a failure or a success.
If the result is a failure a stack trace of where the input failed is passed back along with the position. This should make it easier to see what failed and where.
The following example creates a Defender that when called uses the Guardian to guard the input.
var defend = defender(sayer);
defend(guard(io));
The Fortune Tellers job is to decipher what the input field could possibly look like on key down, before the text has been entered. From there it should be possible to pipe this into the Defenders to then work out if a input is permitted.
The role of a Fortune Teller is highly specialized and because of this a lot more information is required to do the job at hand.
The following uses a value of the current input field, it then grabs what the event is along with any key information (unicode characters etc...) and then finally the selection upon where the new character needs to be added, removed etc.
fortune(value)(fromEvent(e), selection);
A Steward attends over the processing of a value, by looking in to the value, attending to it's various needs before putting the value back into it's original type.
The role of the Steward is to preside over internal modifications of a value.
FAQs
Defending inputs across the land.
We found that defender demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.