
Research
Shai-Hulud Descends to Hades: Miasma Worm Campaign Spreads with New PyPI Wave
Socket found 37 malicious PyPI wheels that abuse Python startup hooks to launch a Bun-powered credential stealer tied to Mini Shai-Hulud/Miasma.
webpack打nodejs包时, 需要配置, browser环境没有限制
作用是ipipe不直接打入包里, (ipipe有调用napi代码, 直接打包后会出现不能正常运行)
externals: {
"ipipe": "ipipe",
},
import IPipe from "ipipe";
import axios from "axios";
let proxy = {
host: "127.0.0.1",
port: 1082,
protocol: 'socks5', //socks5, http
//username: 'user',
//password: '12345'
};
//测试代理
async function testProxy(proxy: { host: string; port: number }) {
let info = await axios({
url: "http://ifconfig.me/ip",
timeout: 15000,
method: "get",
proxy: {
host: proxy.host,
port: proxy.port,
/**auth: {
username: "admin",
password: "123456",
}, */
},
})
.then((res) => res.data)
.catch((err) => console.error("get proxy ip error", err.stack, err.message));
console.info("proxy ip", info);
}
(async()=>{
//step1
//===== 创建接入客户端, 默认可以通过http和socks5协议接入代理
const ipipe = new IPipe(); //初始化实例
await ipipe.createAcceptServer(4321); //创建接入服务kk, 4321 端口是本地接入的端口
ipipe.registerProxy(proxy);//注册代理服务器
//step2 可以跳过, 这里是模拟目标代理服务器
const ipipe2 = new IPipe({
isDirect: true, //不能少这个参数
});
await ipipe2.createAcceptServer(proxy.port); //创建接入服务
//测试代理
testProxy({ host: "127.0.0.1", port: 4321 });
})();
import IPipe from "ipipe";
const peerServer = {
port: 11111,
host: "127.0.0.1",
};
/**
* 启用服务端代码
* 只能在nodejs环境运行
*/
async function server() {
const ipipe = new IPipe({
isDirect: true,
enablePeerServer: true, //启用peer隧道通信服务
auth: async ({username, password}) => { //用于验证用户名和密码
return true;
},
});
//创建 accept socket接入服务
await ipipe.createAcceptServer(peerServer.port, "0.0.0.0", () => {});
//创建 peer 2 peer 点对点接入服务(p2p)
await ipipe.createPeerAcceptServer({
peer: "peer-proxy-server", //节点名, 不能包含 点(.)
server: `ws://${peerServer.host}:${peerServer.port}/peer`,
token: "234",
});
}
/**
* 启用客户端代码, 并发起代理请求
* 可以在nodejs,浏览器环境运行
*/
async function client() {
const ipipe = new IPipe({});
ipipe.createPeerAcceptServer(
{
peer: "peer-client-node", //节点名, 不能包含 点(.)
server: `ws://${peerServer.host}:${peerServer.port}/peer`,
token: "234",
},
async () => {
let res = await ipipe
.fetch("https://ifconfig.me/ip", {
//http://www.people.com.cn/img/2020peopleindex/js/jquery-3.7.0.min.js
agent: {
host: "peer-proxy-server",
port: 0,//如果host是佩尔, port无用
username: "",//传入用户名和密码
password: "",
},
})
.catch((err) => {
console.info("test fetch peer error", err);
});
if (!res) return;
let txt = await res.text();
console.info("=================test fetch peer<", res.status, txt.length, txt, ">");
},
);
}
(async () => {
await server();//启用服务端
await client();//启用客户端
})();
FAQs
IPipe project, include http,socks5,peer
The npm package ipipe receives a total of 60 weekly downloads. As such, ipipe popularity was classified as not popular.
We found that ipipe demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Socket found 37 malicious PyPI wheels that abuse Python startup hooks to launch a Bun-powered credential stealer tied to Mini Shai-Hulud/Miasma.

Security News
RubyGems and Bundler 4.0.13 introduced an opt-in cooldown feature that delays newly published gems during dependency resolution.

Security News
pnpm 11.5 now recognizes npm staged publish approvals in release metadata, preventing those releases from being mistaken for lower-trust package publishes.