
Research
Security News
Malicious npm Packages Use Telegram to Exfiltrate BullX Credentials
Socket uncovers an npm Trojan stealing crypto wallets and BullX credentials via obfuscated code and Telegram exfiltration.
There is only one true thing: instantly paint what you see. When you've got it, you've got it. When you haven't, you begin again. All the rest is humbug.
Manet is a REST API server which allows capturing screenshots of websites using various parameters. It is a good way to make sure that your websites are responsive or to make thumbnails.
Manet could use different engines to work: SlimerJS or PhantomJs.
Project was named in honor of Édouard Manet, French painter (1832-1883). He was one of the first 19th-century artists to paint modern life, and a pivotal figure in the transition from Realism to Impressionism.
Choose and install needed engine (PhantomJS, SlimerJS, or both of them):
npm install -g slimerjs
Gecko, the rendering engine of Firefox, cannot render web content without a graphical window, but you can launch SlimerJS with xvfb if you are under linux or MacOSx, to have a headless SlimerJS, so it is also necessary to install Xvfb (X virtual framebuffer) for *nix or OS X systems.
For example, you can use apt-get to install xvfb on Ubuntu:
sudo apt-get install xvfb
npm install -g phantomjs
or (to use second version):
npm install -g phantomjs2
IMPORTANT: PhantomJS is used by default (see default.yaml
file).
After preliminaries operations you can install Manet using NPM:
npm install -g manet
That is all, now you can start and use Manet server. As you can see, it is unnecessary to clone Git repository or something else.
Server launching is a simple as possible:
manet
If everything is OK, you should see the following message:
info: Manet server started on port 8891
Manet server uses hierarchical configurations to cover differnet usage use-cases:
Rules of overriding:
Built-in configuration could be found in manet
directory. For example, on Ubuntu it is located here: "/usr/local/lib/node_modules/manet/".
Default configuration file ("default.yaml"):
host: 0.0.0.0
port: 8891
cors: false
ui: true
silent: false
level: info
engine: phantomjs
timeout: 60000
compress: false
cache: 3600
cleanupStartup: false
cleanupRuntime: false
commands:
slimerjs:
linux: "xvfb-run -a slimerjs"
freebsd: "xvfb-run -a slimerjs"
sunos: "xvfb-run -a slimerjs"
darwin: "slimerjs"
win32: "slimerjs.bat"
phantomjs:
linux: "phantomjs --ignore-ssl-errors=true --web-security=false"
freebsd: "phantomjs --ignore-ssl-errors=true --web-security=false"
sunos: "phantomjs --ignore-ssl-errors=true --web-security=false"
darwin: "phantomjs --ignore-ssl-errors=true --web-security=false"
win32: "phantomjs --ignore-ssl-errors=true --web-security=false"
whitelist:
- "*"
security:
basic:
# username: admin
# password: admin
REST API is available on "/" using:
Content-Type
:
Few rules:
"url"
parameter must be specified.Format | PhantomJS | SlimerJS |
---|---|---|
JPG | + | + |
PNG | + | + |
HTML | + | + |
BMP | + | - |
+ | - | |
PPM | + | - |
ICO | + | - |
For a quick test with the command line (using curl
), type:
curl http://localhost:8891/?url=github.com > github.png
curl -H "Content-Type: application/json" -d '{"url":"github.com"}' http://localhost:8891/ > github.png
curl -H "Content-Type: application/x-www-form-urlencoded" -d 'url=github.com' http://localhost:8891/ > github.png
or (using wget
)
wget http://localhost:8891/?url=github.com -O github.png
Here are some query examples that could be executed by any REST API client:
# Take a screenshot of the github.com.
GET /?url=github.com
# Custom viewport size. Return a 800x600 PNG screenshot of the github.com homepage.
GET /?url=github.com&width=800&height=600
# Clipping Rectangle. Return a screenshot clipped at [top=20, left=30, width=90, height=80]
GET /?url=github.com&clipRect=20%2C30%2C90%2C80
# Zoom rendered page in 2 times.
GET /?url=github.com&zoom=2
# Specify image output format.
GET /?url=github.com&format=jpeg
# Disable JavaScript. Return a screenshot with no JavaScript executed.
GET /?url=github.com&js=false
# Disable images. Return a screenshot without images.
GET /?url=github.com&images=false
# Custom User Agent.
GET /?url=github.com&agent=Mozilla%2F5.0+(X11%3B+Linux+x86_64)+AppleWebKit%2F537.36+(KHTML%2C+like+Gecko)+Chrome%2F34.0.1847.132+Safari%2F537.36
# HTTP Basic Authentication. Return a screenshot of a website requiring basic authentication.
GET /?url=mysite.com&user=john&password=smith
# Screenshot delay. Return a screenshot of the github.com homepage 1 second after it's loaded.
GET /?url=github.com&delay=1000
# Force page reloading. Return a screenshot without using file cache.
GET /?url=github.com&force=true
# Wait for a div element with a class name "header" to be available.
GET /?url=github.com&selector=div.header
# Specify custom HTTP headers.
GET /?url=google.com&headers=User-Agent=Firefox;Accept-Charset=utf-8
# Asynchronous call.
GET /?url=github.com&callback=http://localhost:8891
Sandbox UI is available on "/" by direct GET request without "url"
query parameter.
It is a simple playground to build HTTP requests and try them.
Demo instance is available on Heroku: https://manet.herokuapp.com
You can also use "Deploy to Heroku" button to create your own Manet instance on Heroku without leaving the web browser, and with little configuration.
npm install
npm run lint
# using NPM:
npm test
# using mocha and watcher:
mocha --watch -R spec
./bin/manet
Ruby:
Docker is an open platform to build, ship, and run distributed applications, whether on laptops, data center VMs, or the cloud.
Manet has some already known Dockerfile
s:
First of all read https://devcenter.heroku.com/articles/deploying-nodejs (section "Deploy your application to Heroku"). You need to create Heroku instance with as described in this documentation.
Procfile file for PhantomJS is already existed in root of the project. This file describes Heroku how to start Manet.
SlimerJS does not work on Heroku, because it has not got a headless mode and it is quite complicated to install xvfb on this platform (but you can try your luck).
One picture more than a thousand words:
The MIT License (MIT)
Copyright (c) 2014 Vladislav Bauer (see LICENSE).
FAQs
Website screenshot service powered by Node.js, SlimerJS and PhantomJS
The npm package manet receives a total of 54 weekly downloads. As such, manet popularity was classified as not popular.
We found that manet demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket uncovers an npm Trojan stealing crypto wallets and BullX credentials via obfuscated code and Telegram exfiltration.
Research
Security News
Malicious npm packages posing as developer tools target macOS Cursor IDE users, stealing credentials and modifying files to gain persistent backdoor access.
Security News
AI-generated slop reports are making bug bounty triage harder, wasting maintainer time, and straining trust in vulnerability disclosure programs.