
Research
Malicious fezbox npm Package Steals Browser Passwords from Cookies via Innovative QR Code Steganographic Technique
A malicious package uses a QR code as steganography in an innovative technique.
Since it is a totally separate tool you don't have to integrate it into your project's backend and it works with any language.
hotcode is a local development tool that allows you to watch for file changes on a local file path and reloads your web project as a result of a change.
This means you don't have to hit refresh every time you make a change and if the change is a css file it allows you to refresh the CSS without loosing state on the current page.
npm install hotcode
hotcode
in terminalopen http://host:port
)http://projectname.mydomain.com
) in "Url" input, press return./var/www/projectname/
) in "Watch path" input, press return.hotcode -p 8000 -u vhost.local -s
8080
vhost.local
You can add a helper file to hotcode so that you don't have to enter the watch path every time you enter an url.
At ~/.hotcode
you can insert:
module.exports = [
{
'regex': /http:\/\/(.+?).mydomain.com/
, 'watches': function(regexMatches, callback) {
callback(null, '/var/www/'+regexMatches[1]);
}
}
];
This makes it so that hotcode will insert the path /var/www/subdomain
automatically when you insert an url matching the regex supplied.
Add http://yourhost:8080/static/injected.js as a script on your project page or through a http proxy like Glimmerblocker.
<script src="http://yourhost:8080/static/injected.js" type="text/javascript"></script>
var hcH = document.getElementsByTagName('HEAD').item(0);
var hcS= document.createElement("script");
hcS.type = "text/javascript";
hcS.src="http://yourhost:8080/static/injected.js";
hcH.appendChild(hcS);
FAQs
File monitor script for local development.
The npm package hotcode receives a total of 8 weekly downloads. As such, hotcode popularity was classified as not popular.
We found that hotcode demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
A malicious package uses a QR code as steganography in an innovative technique.
Research
/Security News
Socket identified 80 fake candidates targeting engineering roles, including suspected North Korean operators, exposing the new reality of hiring as a security function.
Application Security
/Research
/Security News
Socket detected multiple compromised CrowdStrike npm packages, continuing the "Shai-Hulud" supply chain attack that has now impacted nearly 500 packages.