Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
You will need node v0.10.21 and npm v1.3.11 (comes with node) or a more recent version in order to start using it.
Once you have node
and npm
on your machine, install with:
$ npm install -g fingi
Or just add sudo
if you need root access:
$ sudo npm install -g fingi
This should installs you a fingi
script in your $PATH
. The script also creates a
lmdb database at $HOME/.fingi
for storing device credentitals for convenience.
Remove the $HOME/.fingi
folder from your machine to start over with a fresh
installation.
Uninstalls by simply removing the module from your global install:
$ npm rm -g fingi
You can switch between staging and production environment by exporting a NODE_ENV
environment variable before running the command:
$ NODE_ENV=staging fingi connect cli-test # connects cli-test to staging node
$ NODE_ENV=production fingi connect cli-test # connects cli-test to production node
Or you can set the env
configuration key directly so the CLI use the given
environment by default.
$ fingi set env production # always works with production configuration.
Shows the help, obviously.
Sends an HTTP register POST message to the Fingi Operational Services server to obtain
authentication information for the specified device-id
. The device must be added to the
FOS first before this call will work.
Afterwards, the command will saves the returned authorization token and secret for you automatically for use with other commands.
Specify --insecure
to bypass SSL errors.
Alternatively, you can set the authorization token and secret to use with the specified
device-id
directly by using this command.
Connects to the Fingi messsaging hub over an SSL connection. If a device-id
is specified
and there is authorization information saved for it previously, then an IDENTIIFY
line
is constructed and sent automatically for you to authorizes the connection as soon as it
is established.
Omit the device-id
to connects manually or experiment in unauthorized connection mode.
After the connection is established, typing into STDIN will send it directly to the hub.
Type QUIT
to terminate the connection.
Specify --insecure
to bypass SSL errors.
Sends an HTTP GET request to the Fingi Operational Services server to obtain current room
information for the specified device-id
. The device must be properly added to the FOS
and registered (via auth
or register
command) for this request to work.
Optionally you can provide a json_path
which will be used to select specific values from
JSON object returned from the API. Google "JSONPath" for more information.
Specify --insecure
to bypass SSL errors.
Shows everything that's saved into your local database.
Shows information about device-id
or the specified key
that is saved in your local
database.
Prints the raw value of the specified key
from your local database.
Optionally you can provide a json_path
which, if the result is a valid JSON, will be
used to select specific value to be printed instead. Google "JSONPath" for more
information.
Saves the given value to the specified key
in your local database. value
is
automatically converted to JSON when possible.
Removes a key from your local database. You can use this to remove information about device you no longer need or to reset configuration to default, for example.
MIT. See the LICENSE file for the full text.
FAQs
Official Fingi CLI tool.
We found that fingi demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.