Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
"g'day"
Has npm link
or yarn link
got you down? 😃😭
Does your linked package have troublesome "singleton" dependencies that begin to double-up, like react
?
Maybe your code bundler trips up when traversing weird ol' symlinks?
Perhaps you're allergic to or straight up don't trust those `link` commands? 🤷
...
👉🦘 Well, give up now and try linkaroo
. 🦘👍😉 wink
npm i -g linkaroo
Paaaaack your package!
$ cd my-pkg && npm run build
$ linkaroo pack
Liiiiiink it up!
$ cd my-app
$ linkaroo link "my-pkg@1.0.0"
Repeat steps 1 & 2 when my-pkg
chaaaaanges.
👏 DONE 👏
👏 DONE 👏
Sponsored* by the Australian Government
*: It's not
Using npm/yarn link
can be dissapointing in real life, because our node & bundlers get messed up traversing symlinks; they get stuck and find interdependant packages they were NOT suppose to... 😡
So let's just pretend to publish
and install
during local iterations.
That's what these two commands pretend to do:
pack
will prepare your package in a tarball (like publishing) and put it somewhere safe on your machinelink
will unpack that tarball into your other dependants node_modules/
directory (like a dirty lazy npm install
)Thanks to the NPM team for making their CLI easy to use.
MIT
FAQs
Like npm link, but "npm pack -> copy -> untar".
We found that linkaroo demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.