
Research
/Security News
Critical Vulnerability in NestJS Devtools: Localhost RCE via Sandbox Escape
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
Simple FTP client for node.js implemented in pure JavaScript. Useful for downloading files from a remote location, therefore it implements just a small subset of the FTP protocol. Includes a method, modeled after HTTP's HEAD in order to check the existence of a remote resource without downloading its contents. The ftp.head() method uses the FTP SIZE command which a RFC 3659 extension to the protocol, since 2007. However, in practice most FTP servers implement the SIZE extension before the RFC publishing date.
Either manually clone this repository into your node_modules directory, or the recommended method:
npm install ftp-get
Unlike 0.2 and before, the 0.3 version of ftp-get went through extensive testing with real world FTP servers. However, some edge cases may still fail. Therefore, in order to have a proper bug repot I'm kindly asking you to provide the troublesome FTP URL (if possible).
I'd appreciate the output of this script as well:
NODE_ENV=development node client.js ftp://example.com/ftp/url.foo
// client.js
var ftp = require('ftp-get')
var url = process.argv[2]
ftp.get(url, 'dl.bin', function (err, res) {
console.log(err, res)
})
v0.3.1
FAQs
Simple to use node.js FTP client for downloading remote files
The npm package ftp-get receives a total of 65 weekly downloads. As such, ftp-get popularity was classified as not popular.
We found that ftp-get demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
Product
Customize license detection with Socket’s new license overlays: gain control, reduce noise, and handle edge cases with precision.
Product
Socket now supports Rust and Cargo, offering package search for all users and experimental SBOM generation for enterprise projects.