Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Schedule shell commands execution through Google Calendar
Google Calendar
+ Cron
+ Node.js
Start gcalcron:
$ gcalcron start '0 0 10 * * *'
[INFO] Process started checking your calendar: 10:00:00 every day
Insert an event starting at 10:00 through Google Calendar:
Back in the terminal:
[INFO] Executed: 'ls -l | grep file.txt'
-rw-r--r-- 1 antonio 1796131739 11 Sep 24 15:14 file.txt
Install it as a global module:
$ npm install -g gcalcron
gcalcron
, setting the check interval using cron syntaxAuthorization and authentication is done with OAuth 2.0.
Ok, this will take only about 2 minutes:
You will need a file with your credentials: client ID
, client secret
and redirect URI
. This can be obtained in the Developer Console:
Credentials
Create credentials
→ OAuth client ID
(Application type
must be Other
)Once we got the credentials we must generate a consent page URL.
$ gcalcron generateUrl
(By default, the credentials will be searched in your home directory under the name client_secret.json
)
The page will prompt you to authorize access, follow the instructions.
With the code we got through the authorization page, we can obtain a token and store it in our machine.
$ gcalcron storeToken <code>
(By default, the token is stored in your home folder under the name calendar_api_token.json
).
NOTE: The token will expiry after one hour, but a refresh_token
is included as well, allowing the app to refresh automatically the token each time it's used.
With this we are good to go. The stored token and credentials files will be required from now on to use this tool.
Syntax:
gcalcron start <cron-time> [--out <file> --err <file>]
<cron-time>
must be in the form of cron syntax, with this the check frequency will be set.
--out <file>
and --err <file>
are optional, executed commands output and error output can be set using these options. By default, stdio
and sterr
will be used.
The next example will check your Google Calendar every hour printing the executed commands output in a text file:
$ gcalcron start '0 0 * * * *' --out ./output.txt
The Cron functionality is powered by node-cron, for more info about the syntax check the repository README.
The events have to start with Execute:
, followed by the shell command you want to execute.
Execute: /some/random/script.sh
The command can be specified in the event description instead, in case the description has content, the command in the title will be ignored.
NOTE: Execute:
must be written always, what is ignored is whatever is written after Execute:
.
The range of time when the command will be executed. It will be executed only once, after it's executed the title of the event is renamed to from Execute: foo
to [Executed] foo
.
Recurring events will be executed once per occurrence.
NOTE: If, for example, an event is set from 20:00 to 21:00, you have to make sure that gcalcron
is going to check your calendar at least once per hour.
Using the option -C <file>
you can set your own config. This file must be .js
or .json
.
Example:
/somepath/config.json
{
"CRED_PATH": "/my/secret/path/credentials.json",
"TOKEN_PATH": "/my/secret/path/token.json",
}
$ gcalcron -C /somepath/config.json generateUrl
$ gcalcron -C /somepath/config.json storeToken 1249asdjasop12
$ gcalcron -C /somepath/config.json start "0,30 * * * * *"
With the above config your token will be stored in /my/secret/path/credentials.json
, and your token and credentials will be read from there as well.
The available options are:
Path to your credentials file. (Default: located in your home directory under the name client_secret.json
)
Path to your token. (Default: located in your home directory under the name calendar_api_token.json
)
The ID of the calendar you want to use. (Default: primary
calendar)
In case there are several events to be executed, this set the execution order (always ascending). Acceptable values are updated
and startTime
. (Default: startTime
)
Write command output to a an specified file. (Default: stdout
).
Same as the option -o, --output <file>
. In case both are set, the option has preference.
Write command errors to a an specified file. (Default: stderr
)
Same as the option -e, --error <file>
. In case both are set, the option has preference.
Shell to execute the command with. (Default: /bin/sh
on UNIX, process.env.ComSpec
on Windows)
Use the help
command.
$ gcalcron help
gcalcron
can be used altogether with gcal to insert events programmatically. They share the same authentication process, so you can get to use it out-of-the-box.
MIT © Antonio V
FAQs
> Schedule shell commands execution through Google Calendar
The npm package gcalcron receives a total of 0 weekly downloads. As such, gcalcron popularity was classified as not popular.
We found that gcalcron demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.