Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
electron-cgi
Advanced tools
Library to connect node applications to other apps using the stdin/stdout much like what was done in the 90s with CGI (common gateway interface)
Electron CGI is a NodeJs library (npm package: electron-cgi) that makes interacting with executables from other languages easy.
Currently there's support for .Net through the ElectronCgi.DotNet Nuget package.
Here's an example of how you can interact with a .Net application (more examples here):
In NodeJs/Electron:
const { ConnectionBuilder } = require('electron-cgi');
const connection = new ConnectionBuilder()
.connectTo('dotnet', 'run', '--project', 'DotNetConsoleProjectWithElectronCgiDotNetNugetPackage')
.build();
connection.onDisconnect = () => {
console.log('Lost connection to the .Net process');
};
connection.send('greeting', 'John', (error, theGreeting) => {
if (error) {
console.log(error); //serialized exception from the .NET handler
return;
}
console.log(theGreeting); // will print "Hello John!"
});
//alternatively use async/await, in an async function:
try{
const greeting = await connection.send('greeting', 'John');
console.log(greeting);
}catch (err) {
console.log(err); //err is the serialized exception thrown in the .NET handler for the greeting request
}
connection.close();
And in the .Net Console Application:
using ElectronCgi.DotNet;
//...
static void Main(string[] args)
{
var connection = new ConnectionBuilder()
.WithLogging()
.Build();
// expects a request named "greeting" with a string argument and returns a string
connection.On("greeting", (string name) =>
{
return $"Hello {name}!";
});
// wait for incoming requests
connection.Listen();
}
Electron CGI establishes a "connection" with an external process. That external process must be configured to accept that connection. In the example above that's what the Listen
method does.
In Node we can "send" requests (for example "greeting" with "John" as a parameter) and receive a response from the other process.
The way this communication channel is established is by using the connected process' stdin and stdout streams. This approach does not rely on starting up a web server and because of that introduces very little overhead in terms of the requests' round-trip time.
.send
, for example connection.send('getAlll', (err, allResults) => {...})
Alignment of the API for making requests with Node.js conventions (this is a breaking change)
connection.send('requestId', args, (error, response) => {...})
Ability to use promises. If no callback is provided send
returns a promise:
try{
const result = await connection.send('request', args);
//use result
}catch(error) {
//handle error
}
Errors propagate from .NET to Node.js (requires NuGet package ElectronCgi.DotNet version 1.0.1)
Arguments are now optional in connection.send
(e.g. this is valid: connection.send('start')
)
Bugfixes
In .Net:
var posts = await GetNewPosts();
connection.Send("new-posts", posts);
Node.js:
connection.on('new-posts', posts => {
console.log('Received posts from Net:');
posts.forEach(post => {
console.log(post.title);
});
});
FAQs
Library to connect node applications to other apps using the stdin/stdout much like what was done in the 90s with CGI (common gateway interface)
The npm package electron-cgi receives a total of 298 weekly downloads. As such, electron-cgi popularity was classified as not popular.
We found that electron-cgi demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.