
Research
Security News
Malicious PyPI Package Exploits Deezer API for Coordinated Music Piracy
Socket researchers uncovered a malicious PyPI package exploiting Deezer’s API to enable coordinated music piracy through API abuse and C2 server control.
#Description Maiordomus is a command line application that allows to define multiple operation flows which can be executed locally or on one or many remote machines simultaneously. Check the project maiordomus-examples for real use case.
##Requirements To run it needs OpenSSH and node in the local machine and an OpenSSH server in the remote ones.
##Install
npm install -g maiordomus
##Usage Maiordomus can be launched from the command line using the following arguments:
###Setup Maiordomus expects to find a maiordomus folder on the root of your project containing a configuration file called config.js and tasks files. Eg:
myAwesomeWebApp
----maiordomus
--------config.js
--------task.js
----server.js
----package.json
####Configuration file This is an example of a configuration file:
/* MaiorDomus configuration */
module.exports = {
// List of all the possible vbariables used to enrich commands
variables: {
logMessage: 'Application deployed'
},
// List of all the possible environments
environments: {
staging: {
// list of hosts that compose the environment
host: ['staging'],
// Username used to connect
username: 'nodeuser',
// Private key used for authentication
privateKey: require('fs').readFileSync('/path/to/key'),
},
// environment name
production: {
// list of hosts that compose the environment
host: ['production.01', 'production.02'],
// SSH port used to connect
port: 2222,
// Username used to connect
username: 'ec2-user',
// Private key used for authentication
privateKey: require('fs').readFileSync('/path/to/key'),
// Define enviornment specif values for variables
variables: {
logMessage: 'Application deployed in production'
}
}
}
};
####Tasks files Tasks are used to define one or more steps. Take a look at this simple task:
// Require maiordomus
var geoffrey = require('maiordomus');
// Start defining the task and its steps sequentially
geoffrey
// first step
.step(
'StopApplication', // Step name
[ stopApplication ] // List of step actions
).step(
'CleanAndStart', // Step name
[ cleanLogs, startApplication ] // List of step actions
);
// Function used in steps
function startApplication() {
var maiordomus = this;
maiordomus
.connect()
.exec('service myApp start')
.done('<%= logMessage %>');
}
function stopApplication() {
var maiordomus = this;
maiordomus
.connect()
.exec('service myApp stop')
.done();
}
function cleanLogs() {
var maiordomus = this;
maiordomus
.connect()
.exec('rm -f /logs/myApp/*.log')
.done();
}
//Export the task
module.exports = geoffrey;
The task is pretty self explanatory, check this repo for more real use cases. Actions need to use the Maiordomus API to let the main application manage the steps and the actions flow in the right order; done must be called always at the end of each action.
####Templating
Maiorodmus uses the lodash template syntax to enrich logs and commands passed to its API. It uses properties coming from the configuration.variables
object extended with
environment specific variables
object.
##API Currently Maiordomus provides different API if it's used inside an action or inside the body of a task. Inside a task it just provides the step method that allow you to define a list of steps, all the other methods are available inside actions.
message
on the current console.function mixedExecute() {
var maiordomus = this;
maiordomus
// executed locally
.exec('ls -la /var/wwww')
.connect()
// executed remotely
.exec('ls -la /var/www')
.disconnect()
// executed locally
.exec('ls -la /var/www')
.done();
}
Done
message.FAQs
Multiple remote server management tool
The npm package maiordomus receives a total of 1 weekly downloads. As such, maiordomus popularity was classified as not popular.
We found that maiordomus demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket researchers uncovered a malicious PyPI package exploiting Deezer’s API to enable coordinated music piracy through API abuse and C2 server control.
Research
The Socket Research Team discovered a malicious npm package, '@ton-wallet/create', stealing cryptocurrency wallet keys from developers and users in the TON ecosystem.
Security News
Newly introduced telemetry in devenv 1.4 sparked a backlash over privacy concerns, leading to the removal of its AI-powered feature after strong community pushback.