
Security News
/Research
Wallet-Draining npm Package Impersonates Nodemailer to Hijack Crypto Transactions
Malicious npm package impersonates Nodemailer and drains wallets by hijacking crypto transactions across multiple blockchains.
LeNode is a lesser (minimalistic) NodeJS based Web-server
You can setup your server by creating .indexes files by JSON format in any directory like this:
{
"index_own.js" : {
"executable" : true,
"charset" : "utf8"
},
"second_own_index.html" : {
"charset" : "win1251"
},
"third_own_index.ext" : {}
}
You can execute any file with any extension as a JS file. Any directory will get its parent indexes if you don't overwrite them Next, your executable pages must be created wrapped in page() function like this
page(
write, // function that writes contents directly to page without buffering
GET, // GET object (PHP analogue)
POST, // POST object (PHP analogue)
REQUEST, // REQUEST object (PHP analogue)
headers, // request headers
IP, // remote client IP
addHeaders, // function that adds headers to queue (if you're used write(), headers will be placed no more). For setting responce code, you may use addHeaders({code:200}) (200 is default). If you will set an existing header, it will be overwrited by new
polymorph // a function, that ables you easily to create an overflowed functions. Usage:
/*
var func = polymorph(
function(a,b,c){return '3 any args passed';},
{i: String, a: Boolean},
function(i,a){return 'Passed string and boolean';}
);
*/
){
return 'Hell O MFs';
}
On Windows 10 machine it using ~8-9 MBs of memory
Any changes (excluding main server file) will be applied immediately, there are no need to restart the server
FAQs
NodeJS based minimalistic web-server
The npm package lenode receives a total of 0 weekly downloads. As such, lenode popularity was classified as not popular.
We found that lenode demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
/Research
Malicious npm package impersonates Nodemailer and drains wallets by hijacking crypto transactions across multiple blockchains.
Security News
This episode explores the hard problem of reachability analysis, from static analysis limits to handling dynamic languages and massive dependency trees.
Security News
/Research
Malicious Nx npm versions stole secrets and wallet info using AI CLI tools; Socket’s AI scanner detected the supply chain attack and flagged the malware.