
Security News
/Research
Wallet-Draining npm Package Impersonates Nodemailer to Hijack Crypto Transactions
Malicious npm package impersonates Nodemailer and drains wallets by hijacking crypto transactions across multiple blockchains.
Unobtrusive transparent proxies with very little setup. Doesn't require re-writing existing code. You can just drop it right in!
Runs anywhere there's javascript (browser & node).
--> (layer) --> (function/object)
// add a simple proxy without modifying any existing code!
var addBig = function(x, y, next) {
x = x * 100;
y = y * 100;
next(x, y);
}
var that = this;
layer.set(that, add, addBig);
// existing code...
function add(x, y) {
return x + y;
}
add(2, 2); // 400
And that's it, all instances of calling add()
in your existing code now go through addBig()
then add()
You don't re-write your code! Or have to call addBig()
directly.
(Note: this won't work in node.js because add
is private, see here.)
For some fun stuff you can do with layer, check out intercept.js.
layer.set(context, function to proxy, proxy function)
Context being scope or this, read more about it here.
In the browser when you set 'null' as the context, it'll default to global (browser only).
layer.unset(func)
or following the example: layer.unset(add)
For those times when you want turn skip a layer...
func.skip()
or following out add example add.skip(2, 2)
layer.replace(context, function to replace, new function)
At anytime you may stop early by not calling next
.
And either call your callback (async) or return (sync);
node:
npm install layer
browser:
use layer.min.js
(You can't proxy private variables!)
Because they're private. Not a big deal, and it's obvious enough. But keep in mind that in a node.js, the root of the module all your var's are effectively private (so the readme example above will not work).
Work around would be exports.add
and the context being 'exports' would work.
Or if add was in an object var obj = { add: ... }
, context being 'obj'.
(Basically, it works like normal except for private variables.)
Some more examples:
var somelib = require('somelib');
layer.set(somelib, somelib.func, proxyFn)
function Cat() {}
Cat.prototype.meow = function() {...}
layer.set(Cat.prototype, Cat.prototype.meow, proxyFn)
FAQs
transparently proxies functions, objects
The npm package layer receives a total of 208 weekly downloads. As such, layer popularity was classified as not popular.
We found that layer demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
/Research
Malicious npm package impersonates Nodemailer and drains wallets by hijacking crypto transactions across multiple blockchains.
Security News
This episode explores the hard problem of reachability analysis, from static analysis limits to handling dynamic languages and massive dependency trees.
Security News
/Research
Malicious Nx npm versions stole secrets and wallet info using AI CLI tools; Socket’s AI scanner detected the supply chain attack and flagged the malware.