Research
Security News
Threat Actor Exposes Playbook for Exploiting npm to Build Blockchain-Powered Botnets
A threat actor's playbook for exploiting the npm ecosystem was exposed on the dark web, detailing how to build a blockchain-powered botnet.
electron-sudo
Advanced tools
Electron subprocess with administrative privileges, prompting the user with an OS dialog if necessary.
Run a subprocess with administrative privileges, prompting the user with a graphical OS dialog if necessary. Useful for background subprocesse which run native Electron apps that need sudo.
Windows
, uses elevate utility with native User Account Control (UAC)
prompt (no PowerShell
required)OS X
, uses bundled applet (inspired by Joran Dirk Greef)Linux
, uses system pkexec
or gksudo (system or bundled).If you don't trust binaries bundled in npm
package you can manually build tools and use them instead.
spawn
and exec
subprocess behaviorasar
archivesh
or bat
script for single prompt)npm install electron-sudo
Note: Your command should not start with the sudo
prefix.
import Sudoer from 'electron-sudo';
let options = {name: 'electron sudo application'},
sudoer = new Sudoer(options);
/* Spawn subprocess behavior */
let cp = await sudoer.spawn(
'echo', ['$PARAM'], {env: {PARAM: 'VALUE'}}
);
cp.on('close', () => {
/*
cp.output.stdout (Buffer)
cp.output.stderr (Buffer)
*/
});
/* Exec subprocess behavior */
let result = await sudoer.exec(
'echo $PARAM', {env: {PARAM: 'VALUE'}}
);
/* result is Buffer with mixed (both stdout and stderr) output */
/* Usage with Vanila JS */
var Sudoer = require('electron-sudo').default;
var sudoer = new Sudoer(options);
sudoer.spawn('echo', ['$PARAM'], {env: {PARAM: 'VALUE'}}).then(function (cp) {
/*
cp.output.stdout (Buffer)
cp.output.stderr (Buffer)
*/
});
var sudo = require('electron-sudo');
var options = {
name: 'Your application name',
icns: '/path/to/icns/file' // (optional, only for MacOS),
process: {
options: {
// Can use custom environment variables for your privileged subprocess
env: {'VAR': 'VALUE'}
// ... and all other subprocess options described here
// https://nodejs.org/api/child_process.html#child_process_child_process_exec_command_options_callback
},
on: function(ps) {
ps.stdout.on('data', function(data) {});
setTimeout(function() {
ps.kill()
}.bind(ps), 50000);
}
}
};
sudo.exec('echo hello', options, function(error) {});
npm i && npm test
Webpack config should contain __dirname
equals true
for work properly
let nodeModules = fs.readdirSync('./node_modules')
.filter((module) => {
return module !== '.bin';
})
.reduce((prev, module) => {
return Object.assign(prev, {[module]: 'commonjs ' + module});
}, {});
export default {
...
target: 'electron',
node: {
/* http://webpack.github.io/docs/configuration.html#node */
__dirname: true
},
externals: nodeModules
};
FAQs
Electron subprocess with administrative privileges, prompting the user with an OS dialog if necessary.
We found that electron-sudo demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A threat actor's playbook for exploiting the npm ecosystem was exposed on the dark web, detailing how to build a blockchain-powered botnet.
Security News
NVD’s backlog surpasses 20,000 CVEs as analysis slows and NIST announces new system updates to address ongoing delays.
Security News
Research
A malicious npm package disguised as a WhatsApp client is exploiting authentication flows with a remote kill switch to exfiltrate data and destroy files.