
Research
/Security News
Intercom’s npm Package Compromised in Ongoing Mini Shai-Hulud Worm Attack
Compromised intercom-client@7.0.4 npm package is tied to the ongoing Mini Shai-Hulud worm attack targeting developer and CI/CD secrets.
http-file-share
Advanced tools
Read and write files under a directory over HTTP
Provides a REST-like interface for GET-ing, PUT-ing and DELETE-ing static files on a server. No attempts at authentication are made, so do not use this module without the appropriate logic to intercept non-authenticated requests — or only ever use it on single-user workstations.
Ultimately, a WebDAV server may be a more complete solution for you if that’s what you need. On the other hand, if you need something quick, simple and doesn’t rely on a bunch of broken modules, this might be your ticket.
npm install http-file-share
The following creates an HTTP server that listens on localhost port 8000 and shares the contents of the public directory under the /shared/ URL.
var http = require("http")
var path = require("path")
var httpFileShare = require("http-file-share")
var sharePath = path.join(__dirname, "public")
var shareRequestHandler = httpFileShare(sharePath, /^\/shared/)
var server = http.createServer(shareRequestHandler)
server.listen(8000, "127.0.0.1", function () {
console.log("Sharing on http://127.0.0.1:8000/shared/")
})
Convenience function that returns a request handler. See the Share constructor below for argument descriptions.
Constructor for a shared directory.
sharePath is the path to the directory you want to share.baseRoute is a regular expression that matches URLs you want this handler to respond to. The default is /^\//.contentTypeMappingFunction is used to specify a function for mapping file paths to Content-type header values. The default is to use the lookup method of the mime module.Handle a request.
request is an http.IncomingMessage object.response is an http.ServerResponse object.FAQs
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Compromised intercom-client@7.0.4 npm package is tied to the ongoing Mini Shai-Hulud worm attack targeting developer and CI/CD secrets.

Research
Socket detected a malicious supply chain attack on PyPI package lightning versions 2.6.2 and 2.6.3, which execute credential-stealing malware on import.

Research
A brand-squatted TanStack npm package used postinstall scripts to steal .env files and exfiltrate developer secrets to an attacker-controlled endpoint.