
Research
Malicious fezbox npm Package Steals Browser Passwords from Cookies via Innovative QR Code Steganographic Technique
A malicious package uses a QR code as steganography in an innovative technique.
Windows UAC elevation that just works.

This module is a thin wrapper around the awesome elevate.exe utility by kliu, which is a small C open source application with x64 and ia32 support that just works.
This module doesn't make use of NodeJS C/C++ bindings and instead relies on executing the .exe
file direcly in a way that is electron friendly even when the application is packaged in an asar
archive.
Of course, this means that this NodeJS module is subjected to the Windows versions and architectures such supports. Windows Vista (or newer) is required.
Install elevator
by running:
$ npm install --save elevator
This function will yield an Error
containing a code that equals
ELEVATE_CANCELLED
if the elevation was cancelled by the user.
Kind: static method of elevator
Summary: Execute a command with UAC elevation
Access: public
Param | Type | Default | Description |
---|---|---|---|
command | Array.<String> | command | |
[options] | Object | {} | options |
[options.terminating] | Boolean | Launches a terminating command processor; equivalent to "cmd /c command". | |
[options.persistent] | Boolean | Launches a persistent command processor; equivalent to "cmd /k command". | |
[options.doNotPushdCurrentDirectory] | Boolean | When using -c or -k, do not pushd the current directory before execution. | |
[options.unicode] | Boolean | When using -c or -k, use Unicode; equivalent to "cmd /u". | |
[options.hidden] | Boolean | When using -c or -k, start "cmd" in hidden mode. | |
[options.waitForTermination] | Boolean | Waits for termination; equivalent to "start /wait command". | |
callback | function | callback (error, stdout, stderr) |
Example
elevator.execute([ 'cmd.exe' ], {
waitForTermination: true
}, function(error, stdout, stderr) {
if (error) {
throw error;
}
console.log(stdout);
console.log(stderr);
});
String
This function will throw an Error
containing a code that equals
ELEVATE_CANCELLED
if the elevation was cancelled by the user.
Kind: static method of elevator
Summary: Execute a command with UAC elevation (Sync)
Returns: String
- stdout buffer
Access: public
Param | Type | Default | Description |
---|---|---|---|
command | Array.<String> | command | |
[options] | Object | {} | options |
[options.terminating] | Boolean | Launches a terminating command processor; equivalent to "cmd /c command". | |
[options.persistent] | Boolean | Launches a persistent command processor; equivalent to "cmd /k command". | |
[options.doNotPushdCurrentDirectory] | Boolean | When using -c or -k, do not pushd the current directory before execution. | |
[options.unicode] | Boolean | When using -c or -k, use Unicode; equivalent to "cmd /u". | |
[options.hidden] | Boolean | When using -c or -k, start "cmd" in hidden mode. | |
[options.waitForTermination] | Boolean | Waits for termination; equivalent to "start /wait command". |
Example
elevator.executeSync([ 'cmd.exe' ], {
waitForTermination: true
});
If you're having any problem, please raise an issue on GitHub and the Resin.io team will be happy to help.
Run the test suite by doing:
$ gulp test
Before submitting a PR, please make sure that you include tests, and that jshint runs without any warning:
$ gulp lint
The project is licensed under the MIT license.
FAQs
Windows UAC elevation that just works
We found that elevator demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
A malicious package uses a QR code as steganography in an innovative technique.
Research
/Security News
Socket identified 80 fake candidates targeting engineering roles, including suspected North Korean operators, exposing the new reality of hiring as a security function.
Application Security
/Research
/Security News
Socket detected multiple compromised CrowdStrike npm packages, continuing the "Shai-Hulud" supply chain attack that has now impacted nearly 500 packages.