
Security News
/Research
Wallet-Draining npm Package Impersonates Nodemailer to Hijack Crypto Transactions
Malicious npm package impersonates Nodemailer and drains wallets by hijacking crypto transactions across multiple blockchains.
Kyatchi (キャッチ catch) is a light NodeJS port of Mailcatcher. Kyatchi is written on top of the super simple Sinatra-like web framework for NodeJS, ExpressJS. The server and client-side javascript is all written in Coffeescript.
Like Mailcatcher Kyatchi runs a super simple SMTP server which catches any message sent to it to display in a web interface. Run Kyatchi, set your favorite app to deliver to smtp://127.0.0.1:1025 instead of your default SMTP server, then check out http://127.0.0.1:1080 to see the mail that's arrived so far.
Kyatchi also sends new messages to the web interface through WebSockets with failover support for ANY browser that doesn't support Websockets. This is done through the power of the awesome and simple pub/sub library Faye.
npm install kyatchi
npm start kyatchi
The source is simple and available on GitHub.
To set up your rails app, I recommend adding this to your environment/development.rb
:
config.action_mailer.delivery_method = :smtp
config.action_mailer.smtp_settings = { :host => "localhost", :port => 1025 }
Doesn't matter what programming language/framework you're using. If it uses smtp to send messages, then Kyatchi will work for you!
I was surprised how quickly I was able to get Kyatchi up and running. We definitely have some very powerful tools at our fingertips right now. A big thanks to all of the authors/contributors of the whole stack used in Kyatchi. I would also like to thank the following people:
I started this project because I've been wanting to write something like this for a while, but I am doing this in my free time. If you are so inclined, buy me a cup of coffee, soda, or some nourishment by donating via Amazon Payments.
Copyright (c) 2011 Haris Amin (aminharis7@gmail.com). Released under the MIT License, see LICENSE for details.
FAQs
Catch the Mail!
The npm package kyatchi receives a total of 6 weekly downloads. As such, kyatchi popularity was classified as not popular.
We found that kyatchi demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
/Research
Malicious npm package impersonates Nodemailer and drains wallets by hijacking crypto transactions across multiple blockchains.
Security News
This episode explores the hard problem of reachability analysis, from static analysis limits to handling dynamic languages and massive dependency trees.
Security News
/Research
Malicious Nx npm versions stole secrets and wallet info using AI CLI tools; Socket’s AI scanner detected the supply chain attack and flagged the malware.