Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
diff-machines
Advanced tools
diff files between machines over ssh.
npm i maboiteaspam/diff-machines -g
diff-machines
is a binary to install globally.
diff files between machines over ssh.
Usage
diff-machines [hostA] [hostB] [files or services...]
diff-machines [opts] -- [hostA] [hostB] [files or services...]
Options
-v verbose
-h show help
Examples
diff-machines user@hostA:port user@hostB:port php .bashrc
diff-machines -v -- vagrant vagrant php .bashrc
diff-machines -h
Example
It will diff the service php
and the file .bashrc
between vagrant
and vagrant
boxes.
diff-machines -v -- vagrant@localhost:2222 vagrant@localhost:2222 php .bashrc
The result is sent to stdout
and produce unified patch with support of jsdiff
# node bin.js vagrant vagrant php .bashrc
Index: /etc/php.ini
===================================================================
--- /etc/php.ini
+++ /etc/php.ini
Index: .bashrc
===================================================================
--- .bashrc
+++ .bashrc
password credentials-like requires you to register the machine into a configuration file
located on cwd
. See below.
Then you must use its alias when you invoke diff-machines
diff-machines -v -- vagrant vagrant php .bashrc
diff-machines
can read a configuration file located on cwd
.
This file exports a function()
which returns an object
.
This configuration object can configure ssh hosts
and services
by name.
service
are functions resolver which receives an sshConn
of ssh2-utils
and invoke call(err, filePath)
.
filePath
is the location of the file identified for the given service
.
configuration
{
host1:{},
host2:{},
services:{
service1: function (sshConn, done){ done(err, filePath); },
service2: function (sshConn, done){ done(err, filePath); }
},
}
In this example,
php
ini file is resolved with the help of the php
binary itself. Cross-distro.
notFound
, demonstrate that passing anything into err
will effectively stop the program.
diff-svc.js
var SSH2 = require('ssh2-utils')
module.exports = function () {
var ssh = new SSH2();
return {
'vagrant': {
'host':'127.0.0.1',
port: 2222,
username: 'vagrant',
password: 'vagrant'
},
'services': {
'php': function (conn, done) {
ssh.exec(conn, 'php -r "echo php_ini_loaded_file();"', function (err, stdout, stderr) {
done(err, stdout)
})
},
'notFound': function (conn, done) {
done(false)
}
}
}
};
It s possible to pass in not service
name of the local
config object, rather than,
module
names.
So if one would export the php
service to a module name php-ini
, that would look like,
index.js
var SSH2 = require('ssh2-utils')
var ssh = new SSH2();
module.exports = function (conn, done) {
ssh.exec(conn, 'php -r "echo php_ini_loaded_file();"', function (err, stdout, stderr) {
done(err, stdout)
});
}
It would then be possible to invoke diff-machines
in such fashion
diff-machines -v -- vagrant vagrant php-ini .bashrc
Obviously you d need to npm i php-ini --save
before that.
Thus lock the remote dependency into a package json of your projects.
Kick-start your hacks like this,
git clone..
vagrant up
node bin.js vagrant vagrant php .bashrc
node bin.js -v -- vagrant vagrant php .bashrc
~/.ssh/config
Host localhost
HostName 127.0.0.1
Port 2222
StrictHostKeyChecking no
FAQs
diff files between machines
The npm package diff-machines receives a total of 0 weekly downloads. As such, diff-machines popularity was classified as not popular.
We found that diff-machines demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.