
Research
PyPI Package Disguised as Instagram Growth Tool Harvests User Credentials
A deceptive PyPI package posing as an Instagram growth tool collects user credentials and sends them to third-party bot services.
locate-executable
Advanced tools
child_process
inside Electron apps)After building an Electron app using electron-builder
, the $PATH
variable inside child_process
may get set to /usr/bin:/bin:/usr/sbin:/sbin
which makes it virtually impossible to spawn additional non-UNIX commands.
This package allows you to locate paths of executable files for such commands. You can then use these paths to spawn child_process
inside the compiled app.
Tested on macOS only. Let me know if it does/not work on Linux/Windows.
npm install --save locate-executable
locateExecutable(command[,subpath][,callback])
Looks for executable files for specified command
in user's home directory recursively. You can narrow down the search by specifying additional subpath
.
command
(String) Command you need the executable ofsubpath
(String) (optional) Specify a particular subpath you want to look atcallback
(Function) (optional)
error
(String)paths
(Array) List of absolute paths to executables// Example
import locateExecutable from 'locate-executable'
locateExecutable('jupyter-console', (error, paths) => {
if (error) console.log(error)
console.log(paths)
return
})
NOTE: As the search inside the home directory recursively can take some time, consider running it only on the first launch and saving the paths persistently in something like electron-store
.
So if you're awesome and want to contribute to this project, go fork, clone and send pull requests! These are the tips for features to work on:
MIT
FAQs
Locate executable files for specific commands
The npm package locate-executable receives a total of 0 weekly downloads. As such, locate-executable popularity was classified as not popular.
We found that locate-executable demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
A deceptive PyPI package posing as an Instagram growth tool collects user credentials and sends them to third-party bot services.
Product
Socket now supports pylock.toml, enabling secure, reproducible Python builds with advanced scanning and full alignment with PEP 751's new standard.
Security News
Research
Socket uncovered two npm packages that register hidden HTTP endpoints to delete all files on command.