Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
duplex-to
wraps a duplex stream with a Proxy
and hides the readable or the writable interface.
Hidding part of the interface can be useful in cases where errors are thrown or the code behaves different based on the interface type.
This package allows to show only one part of a duplex stream for those cases.
The readable
function wraps a duplex stream to show only the readable interface.
It can be loaded either by path or from the main module by property:
import readable from 'duplex-to/readable.js'
import { readable } from 'duplex-to'
The function is a factory which returns the wrapped stream. The stream which should be wrapped must be given as argument:
const readableStream = readable(duplexStream)
The writable
function wraps a duplex stream to show only the writable interface.
It can be loaded either by path or from the main module by property:
import writable from 'duplex-to/writable.js'
import { writable } from 'duplex-to'
The function is a factory which returns the wrapped stream. The stream which should be wrapped must be given as argument:
const writableStream = writable(duplexStream)
The following examples creates a PassThrough
duplex stream, which is used to write a text string and allows to access it via the readable stream interface.
The function noWritablesAccepted
accepts only readable streams and writes the data from the stream to stdout
.
Passing the PassThrough
object to the function would throw an error, but with the wrapper only the readable part is visible to the function.
import duplexToReadable from 'duplex-to/readable.js'
import { isWritableStream } from 'is-stream'
import { PassThrough } from 'readable-stream'
// dummy function which
// - doesn't accept streams with writable interface
// - just writes the incoming data to stdout
function noWritablesAccepted (stream) {
if (isWritableStream(stream)) {
throw new Error('no writable streams supported')
}
stream.on('data', chunk => process.stdout.write(chunk))
}
const stream = new PassThrough()
const readable = duplexToReadable(stream)
// the next line would throw an error if it would be called with stream
noWritablesAccepted(readable)
stream.write('Hello ')
stream.end('World!\n')
FAQs
Wraps a duplex stream and hides the readable or the writable interface
We found that duplex-to demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.