Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
electron-cgi
Advanced tools
Library to connect node applications to other apps using the stdin/stdout much like what was done in the 90s with CGI (common gateway interface)
Electron CGI is a NodeJs library that makes interacting with executables from other languages easy.
Currently there's support for .Net through the ElectronCgi.DotNet Nuget package.
Here's an example of how you can interact with a .Net application:
In NodeJs/Electron:
const { ConnectionBuilder } = require('electron-cgi');
const connection = new ConnectionBuilder()
.connectTo('dotnet', 'run', '--project', 'DotNetConsoleProjectWithElectronCgiDotNetNugetPackage')
.build();
connection.onDisconnect = () => {
console.log('Lost connection to the .Net process');
};
connection.send('greeting', 'John', theGreeting => {
console.log(theGreeting); // will print "Hello John!"
});
connection.close();
And in the .Net Console Application:
using ElectronCgi.DotNet;
//...
static void Main(string[] args)
{
var connection = new ConnectionBuilder()
.WithLogging()
.Build();
// expects a request named "greeting" with a string argument and returns a string
connection.On<string, string>("greeting", name =>
{
return $"Hello {name}!";
});
// wait for incoming requests
connection.Listen();
}
Electron CGI establishes a "connection" with an external process. That external process must be configured to accept that connection. In the example above that's what the Listen
method does.
In Node it is then possible to "send" requests (for example "greeting" with "John" as a parameter) and receive a response from the other process.
The way this communication channel is established is by using the connected process' stdin and stdout streams. This approach does not rely on staring up a web server and because of that introduces very little overhead in terms of the requests' round-trip time.
FAQs
Library to connect node applications to other apps using the stdin/stdout much like what was done in the 90s with CGI (common gateway interface)
We found that electron-cgi demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.