
Research
Security News
Malicious npm Packages Use Telegram to Exfiltrate BullX Credentials
Socket uncovers an npm Trojan stealing crypto wallets and BullX credentials via obfuscated code and Telegram exfiltration.
hook-stream
Advanced tools
Allows listening to a given stream's writes through a new, readable stream.
Useful for listening to a 3rd party library's writes to stdout
or stderr
.
npm install --save hook-stream
hookStream(stream: Stream, options?: Object): [unhook: Function, readable: Stream]
Takes a stream
to hook into and optional options
object.
Returns a tuple of unhook
function and a newly created readable stream that
emits writes to stream
.
Direct writes to stderr
to stdout
.
const hookStream = require('hook-stream')
const map = require('through2-map')
const treis = require('treis')
const [ unhook, stream ] = hookStream(process.stderr)
stream
.pipe(map((x) => `STDOUT ${x}`))
.pipe(process.stdout)
console.error('foo')
process.stderr.write('bar')
// treis prints function input and output to stderr
treis(x => x)(1)
unhook()
% node examples/1.js
STDOUT foo
foo
STDOUT bar
bar
STDOUT λ1 x: 1
λ1 x: 1
STDOUT λ1 => 1
λ1 => 1
This method does not work if a third party lib saves a reference to "original"
stream.write
(e.g. process.stderr.write
) before hookStream
is called.
// somewhere else, maybe in some lib's code
const log = process.stderr.write.bind(process.stderr)
// .....
// won't work because hookStream replaces process.stderr.write with its own
// function, but log already has reference to the original
const [ unhook, stream ] = hookStream(process.stderr)
FAQs
Hook into writes of a stream
The npm package hook-stream receives a total of 3 weekly downloads. As such, hook-stream popularity was classified as not popular.
We found that hook-stream demonstrated a not healthy version release cadence and project activity because the last version was released a year ago.Ā It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket uncovers an npm Trojan stealing crypto wallets and BullX credentials via obfuscated code and Telegram exfiltration.
Research
Security News
Malicious npm packages posing as developer tools target macOS Cursor IDE users, stealing credentials and modifying files to gain persistent backdoor access.
Security News
AI-generated slop reports are making bug bounty triage harder, wasting maintainer time, and straining trust in vulnerability disclosure programs.