
Research
Malicious npm Packages Impersonate Flashbots SDKs, Targeting Ethereum Wallet Credentials
Four npm packages disguised as cryptographic tools steal developer credentials and send them to attacker-controlled Telegram infrastructure.
项目源码摘自淘宝开源项目 pandora ,pandora 是一个淘宝开源的进程管理工具,里面进程间通信的模块很具有参考意义,所以将其单独分离出来做成一个项目。
npm install lrpc --save
const assert = require('assert');
const {Server,Client,util} = require('lrpc');
const msg = {
name: 'midway-messenger',
};
const action = 'midway-messenger-action';
const sockPath = util.getRandomSocketPath();
const server = new Server({sockPath});//直接使用在外部指定的socket地址
const client = new Client({sockPath});
new Promise(function(resolve) {
client.ready(function() {
resolve(client);
});
}).then(function() {
server.broadcast(action, msg);
return new Promise(function(resolve) {
client.on(action, (message) => {
assert(message.name === msg.name);
resolve();
});
});
}).then(function() {
console.info('成功');
assert(true);
}).catch(function() {
assert(false);
});
const name = 'req-res-demo';
const {Server,Client} = require('../index');
const ACTION_CALC = 'actionCalc';
//服务器端代码
const server = new Server({//在内部使用 `name` 字段拼接 socket 地址
name,
});
server.ready((err) => {
if (err) {
return console.error(err);
}
console.log('服务端创建成功');
});
server.on(ACTION_CALC,function(message,reply) {
reply(message.a + message.b);
});
//客户端代码
const client = new Client({
name,
});
client.ready(function(err) {
if (err) {
return console.error(err);
}
console.log('客户端创建成功');
});
client.send(ACTION_CALC,{a:1,b:2},function(err,res) {
console.log('服务端返回数据',res);
});
参见 这里
FAQs
The npm package lrpc receives a total of 0 weekly downloads. As such, lrpc popularity was classified as not popular.
We found that lrpc demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Four npm packages disguised as cryptographic tools steal developer credentials and send them to attacker-controlled Telegram infrastructure.
Security News
Ruby maintainers from Bundler and rbenv teams are building rv to bring Python uv's speed and unified tooling approach to Ruby development.
Security News
Following last week’s supply chain attack, Nx published findings on the GitHub Actions exploit and moved npm publishing to Trusted Publishers.