
Research
PyPI Package Impersonates SymPy to Deliver Cryptomining Malware
Malicious PyPI package sympy-dev targets SymPy users, a Python symbolic math library with 85 million monthly downloads.
Distributed process manager. Listens on a hypercore feed for JSON commands to execute on the host machine using psy.
Usage:
$ hyperlapse <command> [options]
Commands:
listen <hypercore key> Listen for commands and print a log key
append <hypercore key> <command> Append commands onto a feed
list <hypercore key> Print the services on a machine
Process commands:
start <package-name@version> Boot up a service on the host machine
stop
remove
restart
Options:
-h, --help Print usage
-v, --version Print version
var hyperlapse = require('hyperlapse')
var normcore = require('normcore')
// the command feed usually lives remotely
var commandFeed = normcore('command-feed')
var commandKey = commandFeed.key.toString('hex')
var inFeed = normcore(commandKey)
var outFeed = normcore('out-feed')
hyperlapse(inFeed, outFeed)
var outKey = outFeed.key.toString('hex')
console.log('outFeed key is ' + outKey)
commandFeed.append({
type: 'start',
name: 'hypercore-archiver-bot',
source: 'hypercore-archiver-bot@1.1.3',
command: '--channel=#dat --port=8000'
})
Start a new process on the machine.
{
"type": "start",
"name": "what the process should be named on the machine",
"source": "e.g. my-cool-service-on-npm@3.4.7",
"env": {
"a bunch": "of env vars"
}
}
Create a new agent that tails a hypercore. Reads commands from the inFeed
and logs its output to the outFeed.
$ npm install hyperlapse
FAQs
Distributed process manager
The npm package hyperlapse receives a total of 0 weekly downloads. As such, hyperlapse popularity was classified as not popular.
We found that hyperlapse demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Malicious PyPI package sympy-dev targets SymPy users, a Python symbolic math library with 85 million monthly downloads.

Product
Create and share saved alert views with custom tabs on the org alerts page, making it easier for teams to return to consistent, named filter sets.

Product
Socket’s Rust and Cargo support is now generally available, providing dependency analysis and supply chain visibility for Rust projects.