
Research
/Security News
Weaponizing Discord for Command and Control Across npm, PyPI, and RubyGems.org
Socket researchers uncover how threat actors weaponize Discord across the npm, PyPI, and RubyGems ecosystems to exfiltrate sensitive data.
Evaluate javascript in PhantomJS, and print the output.
Inspired by jsdom-eval, this module makes it trivial to run tests in a headless browser.
npm install -g ghostface
will expose the ghostface
command in your
environment.
ghostface
does not include phantomjs as a dependency; you should install
that however works best in your environment, and ghostface
will find it so
long as it exists in your $PATH
.
Imagine a browserify project that you're testing using tape:
// file: test.js
var test = require('tape')
test('always passes', function(t) {
t.plan(1)
t.pass()
})
Run it with ghostface
:
$ browserify test.js | ghostface | faucet
See the output printed to the console:
✓ always passes
# tests 1
# pass 1
✓ ok
Note: In the example above, we pipe output to faucet, which parses TAP
output and sets the correct exit codes; ghostface
is just evaluating
javascript, it doesn't know/care what the output is, or how to set the correct
exit codes.
$ ghostface --help
Usage: ghostface [options] [file]
file Javascript file to be evaluated
Options:
-h --html The HTML file to be used as the page template
-t --timeout Milliseconds to wait for output before stopping execution. Default 1000
-f --forever Ignore the timeout and wait forever
-p --phantomPath Specify the path to the phantomjs executable
--help Show this message
--version Print version and quit
You can specify the JS file to be evaluated, or pipe a JS file directly into
ghostface
. For an imaginary file.js
in the current directory, these two
commands are equivalent:
$ ghostface file.js
$ cat file.js | ghostface
The JS you are evaluating will be done in a blank web page. If you want to
provide your own context, use the --html <filename>
option to load your own
html; the JS will be evaluated after the page loads.
By default, execution is stopped if no console output is seen for over 1000ms.
You can override this timeout with --timeout <ms>
, or choose to run forever
with --forever
. Note you will have to send a SIGHUP
to end execution.
FAQs
Evaluate Javascript in PhantomJS, and print the output.
The npm package ghostface receives a total of 8,500 weekly downloads. As such, ghostface popularity was classified as popular.
We found that ghostface demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
Socket researchers uncover how threat actors weaponize Discord across the npm, PyPI, and RubyGems ecosystems to exfiltrate sensitive data.
Security News
Socket now integrates with Bun 1.3’s Security Scanner API to block risky packages at install time and enforce your organization’s policies in local dev and CI.
Research
The Socket Threat Research Team is tracking weekly intrusions into the npm registry that follow a repeatable adversarial playbook used by North Korean state-sponsored actors.