Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Run a (JavaScript) program with before and after handlers inside the child process. The command can be either a .js
file or a node file.js [...]
command line, or a Node shebang script.
If the wrapped script spawns further sub processes, the wrapping will occur to these as well!
The invoked program will take over standard I/O and become foreground. When the invoked program exits, the parent exits too.
The interface for haxec
is a module exporting a function run
:
const { run } = require( 'haxec' );
// run is defined as:
function run(
wrapModule: string,
cmdWithArgs: Array< string >,
options?: Options
): void;
// where options can contain environment variables in the "env" property:
interface Options
{
env?: { [ key: string ]: string; };
beforeExit?: ( ) => void | Promise< void >;
}
The wrapModule
is your module (it will make sense to provide an absolut path to it) which haxec
will require()
. This module is supposed to export a before
function and/or a after
function. The module will be injected into the command that is being run, so these functions will be called in that process.
run
returns nothing. At this time, the program shouldn't do much else, as the child will take over terminal I/O and exit the parent when the child exits.
Environment variables can be added to the child, using the env
property in the options object.
To perform any final/cleanup work right before the child has exited, provide a beforeExit
callback. If this returns a promise, it will be awaited before exiting the child (and thereby the parent).
const path = require( "path" );
const { run } = require( 'haxec' );
const wrapModule = path.join( __dirname, "child.js" );
run( wrapModule, [ "node", "file.js", "arg1" ] );
// which is same as
run( wrapModule, [ "file.js", "arg1" ] );
// or as a shebang script
run( wrapModule, [ "./script-name.sh", "arg1" ] );
// main.js
const { run } = require( 'haxec' );
run(
path.join( __dirname, "child.js" ),
[ "node", "some-app.js", "arg1" ],
{
env: { foo: "bar" }
}
);
This will run some-app.js
with arg1
as argument. It will inject this file into it and call its hooks before and after some-app.js
is invoked, inside its process:
// child.js
module.exports = {
before( ) {
console.log( "Child has pid", process.pid );
// Inject an environment into this process
process.env.injected = "yes";
// When this function returns, the main "some-app.js" will run, and it
// will have { foo: "bar", injected: "yes" } as environment variables.
},
after( code ) {
console.log( "Child exited with code", code );
},
};
FAQs
Wrap a Node.js spawn() or exec() with before/after handlers
We found that haxec demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.