Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
hazel-server
Advanced tools
This project lets you deploy an update server for Electron apps with ease: You only need to click a button.
The result will be faster and more lightweight than any other solution out there! :rocket:
Open this link in a new tab to deploy Hazel on Vercel:
Once it's deployed, paste the deployment address into your code (please keep in mind that updates should only occur in the production version of the app, not while developing):
const { app, autoUpdater } = require('electron')
const server = <your-deployment-url>
const url = `${server}/update/${process.platform}/${app.getVersion()}`
autoUpdater.setFeedURL({ url })
That's it! :white_check_mark:
From now on, the auto updater will ask your Hazel deployment for updates!
The following environment variables can be used optionally:
INTERVAL
: Refreshes the cache every x minutes (restrictions)PRE
: When defined with a value of 1
, only pre-releases will be cachedTOKEN
: Your GitHub token (for private repos)URL
: The server's URL (for private repos - when running on Vercel, this field is filled with the URL of the deployment automatically)Since Hazel routes all the traffic for downloading the actual application files to GitHub Releases, you can use their API to determine the download count for a certain release.
As an example, check out the latest Hyper release and search for mac.zip
. You'll find a release containing a sub property named download_count
with the amount of downloads as its value.
Displays an overview page showing the cached repository with the different available platforms and file sizes. Links to the repo, releases, specific cached version and direct downloads for each platform are present.
Automatically detects the platform/OS of the visitor by parsing the user agent and then downloads the appropriate copy of your application.
If the latest version of the application wasn't yet pulled from GitHub Releases, it will return a message and the status code 404
. The same happens if the latest release doesn't contain a file for the detected platform.
Accepts a platform (like "darwin" or "win32") to download the appropriate copy your app for. I generally suggest using either process.platform
(more) or os.platform()
(more) to retrieve this string.
If the cache isn't filled yet or doesn't contain a download link for the specified platform, it will respond like /
.
Checks if there is an update available by reading from the cache.
If the latest version of the application wasn't yet pulled from GitHub Releases, it will return the 204
status code. The same happens if the latest release doesn't contain a file for the specified platform.
This endpoint was specifically crafted for the Windows platform (called "win32" in Node.js).
Since the Windows version of Squirrel (the software that powers auto updates inside Electron) requires access to a file named "RELEASES" when checking for updates, this endpoint will respond with a cached version of the file that contains a download link to a .nupkg
file (the application update).
You can add Hazel to an existing HTTP server, if you want. For example, this will allow you to implement custom analytics on certain paths.
const hazel = require('hazel-server')
http.createServer((req, res) => {
hazel(req, res)
})
cd hazel
vercel dev
Huge thanks to my (@leo's) friend Andy, who suggested the name "Hazel" (since the auto updater software inside Electron is called "Squirrel") and Matheus for collecting ideas with me.
Leo Lamprecht (@notquiteleo) - Vercel
FAQs
Lightweight update server for Electron apps
We found that hazel-server demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 80 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.