
Research
/Security News
Critical Vulnerability in NestJS Devtools: Localhost RCE via Sandbox Escape
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
locate-executable
Advanced tools
child_process
inside Electron apps)After building an Electron app using electron-builder
, the $PATH
variable inside child_process
may get set to /usr/bin:/bin:/usr/sbin:/sbin
which makes it virtually impossible to spawn additional non-UNIX commands.
This package allows you to locate paths of executable files for such commands. You can then use these paths to spawn child_process
inside the compiled app.
Tested on macOS only. Let me know if it does/not work on Linux/Windows.
npm install --save locate-executable
locateExecutable(command[,subpath][,callback])
Looks for executable files for specified command
in user's home directory recursively. You can narrow down the search by specifying additional subpath
.
command
(String) Command you need the executable ofsubpath
(String) (optional) Specify a particular subpath you want to look atcallback
(Function) (optional)
error
(String)paths
(Array) List of absolute paths to executables// Example
import locateExecutable from 'locate-executable'
locateExecutable('jupyter-console', (error, paths) => {
if (error) console.log(error)
console.log(paths)
return
})
NOTE: As the search inside the home directory recursively can take some time, consider running it only on the first launch and saving the paths persistently in something like electron-store
.
So if you're awesome and want to contribute to this project, go fork, clone and send pull requests! These are the tips for features to work on:
MIT
FAQs
Locate executable files for specific commands
The npm package locate-executable receives a total of 0 weekly downloads. As such, locate-executable popularity was classified as not popular.
We found that locate-executable demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
Product
Customize license detection with Socket’s new license overlays: gain control, reduce noise, and handle edge cases with precision.
Product
Socket now supports Rust and Cargo, offering package search for all users and experimental SBOM generation for enterprise projects.