
Security News
/Research
Wallet-Draining npm Package Impersonates Nodemailer to Hijack Crypto Transactions
Malicious npm package impersonates Nodemailer and drains wallets by hijacking crypto transactions across multiple blockchains.
fie-plugin-qnproxy
Advanced tools
qnproxy server端,以ws形式透出客户端底层能力服务到连入用户端。
该款插件基于fie工程化解决方案,更多资料请参考FIE前端工程化工具-github
// 安装fie工程化工具
$ npm install fie -g --registry=https://registry.npm.taobao.org
// 安装qnproxy插件
$ fie install plugin-qnproxy
// 启动qnproxy插件
// 如遇异常,请切换至8.x稳定版本node
$ fie qnproxy run
$ fie qnproxy help
启动成功后弹出的代理页面以及自动加载sdk文件
//g.alicdn.com/x-bridge/qap-sdk/2.2.7/qn.js
//g.alicdn.com/sj/qn/jssdk-ex-debug.js
sdk自定义配置:在url增加参数sdk='//127.0.0.1:8080/xxx.sdk.js' 端口自定义配置:url增加参数wsport=3333
服务启动后,我们需要将页面加载到对应的千牛插件中,比如你是“xx商品”插件,那么你需要手动打开千牛“xx商品”,然后打开控制台,location.href="你得到的代理地址",完成服务嵌入,成功之后会看到日志输出。
const fieModule = require('fie-api').module;
const qnproxy = yield fieModule.get('plugin-qnproxy');
yield qnproxy.run(fie, {clientArgs: ['some-args'], clientOptions: { a: 2, b: 2}});
FAQs
fie-plugin-qnproxy description
The npm package fie-plugin-qnproxy receives a total of 1 weekly downloads. As such, fie-plugin-qnproxy popularity was classified as not popular.
We found that fie-plugin-qnproxy demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
/Research
Malicious npm package impersonates Nodemailer and drains wallets by hijacking crypto transactions across multiple blockchains.
Security News
This episode explores the hard problem of reachability analysis, from static analysis limits to handling dynamic languages and massive dependency trees.
Security News
/Research
Malicious Nx npm versions stole secrets and wallet info using AI CLI tools; Socket’s AI scanner detected the supply chain attack and flagged the malware.