Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
What is a halfpenny, anyway? Beyond an old-timey coin, halfpenny is the official javascript API client for the COINS platform.
halfpenny is still in active development! it is not ready for public usage
In order to keep the use of this client as flexible as possible, the client needs to be initialized with a function that can be used to make XHR requests. The client was designed to work with the request package, but it can be adapted to work with others (like browser-request, or xhr).
const request = require('request');
const Promise = require('bluebird');
const apiClientOptions = {
requestFn: Promise.promisify(request),
baseUrl: 'http://localhost:3000'
};j
const client = require('../sdk/index.js')(apiClientOptions);
The above configuration parameters are required. Note that the 'requestFn' must be promisified
This client can use multiple request engines to make requests to the API. This
allows the COINS team to use the client for its integration tests as well as
for its browser application. Most of the configuration is centered around mapping
the parameters that the client will feed to the request engine. If you are using
request as your request engine, then there is no configuration needed. See
nodeapi/test/utils/init-api-client
for an example of how to configure the
client to use hapi server.injectThen.
Once you have a configured client, you can use the following methods to interact with the COINS API:
Sends POST request to /auth/keys, and stores resulting credentials.
Sends DELETE request to /auth/keys, and removes credentials.
Get the credentials currently stored.
Set the credentials stored: will overwrite if already set.
Takes a set of request options formatted for the request library, and
modifies the options according to the requestObjectMap before signing the
request (if sign !== false
) and sending it.
See nodeapi/test/integration/keys.js
FAQs
Official JavaScript client for steelpenny.
The npm package halfpenny receives a total of 4 weekly downloads. As such, halfpenny popularity was classified as not popular.
We found that halfpenny demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 7 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.