Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
electron-react-devtools
Advanced tools
Unfortunately, React DevTools
is not working with Electron(<=v1.2.0). Because not implemented
chrome.runtime*
APIs and not support Background Pages
in Electron. So I fix
the source of "React DevTools" for Electron.
npm install --save-dev electron-react-devtools
or
npm install --save-dev firejune/electron-react-devtools
You will still see the React DevTools message('Download the React DevTools
and ...') in Console
tab.
Then execute the following from the Console tab of your running Electron app's developer tools:
require('electron-react-devtools').install()
And than refresh or restart the renderer process, you can see a React
tab added.
npm install
npm run build
in this directorywebpack
or webpack --watch
in this directorychrome://extensions
, check "developer mode", and click "Load
unpacked extension", and select this directoryGenerally, changes to the UI will auto-propagate if you have webpack --watch
on (close devtools and re-open them). If you change the background script or
injector, you might have to reload the extension from the extensions page.
React Devtools has part of the code (the backend + agent) running in the same
javascript context as the inspected page, which makes the code vulnerable to
environmental inconsistencies. For example, the backend uses the es6 Map
class and normally expects it to be available in the global scope. If a user
script has overridden this, the backend breaks.
To prevent this, the content script src/GlobalHook.js
,
which runs before any user js, saves the native values we depend on to the
__REACT_DEVTOOLS_GLOBAL_HOOK__
global. These are:
Then in webpack.backend.js
, these saved values are substituted for the
globally referenced name (e.g. Map
gets replaced with
window.__REACT_DEVTOOLS_GLOBAL_HOOK__.nativeMap
).
React Native sets document.createElement
to null
in order to convince js
libs that they are not running in a browser environment while debug in chrome
is enabled.
To deal with this, src/inject.js
calls
document.constructor.prototype.createElement
when it needs to create a
<script>
tag.
FAQs
React DevTools Extension for Electron
The npm package electron-react-devtools receives a total of 647 weekly downloads. As such, electron-react-devtools popularity was classified as not popular.
We found that electron-react-devtools demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.