
Research
/Security News
npm Malware Campaign Uses Adspect Cloaking to Deliver Malicious Redirects
Malicious npm packages use Adspect cloaking and fake CAPTCHAs to fingerprint visitors and redirect victims to crypto-themed scam sites.
mono.csharp
Advanced tools
JOI Javascript Oriented Interoperability.
This module requires .NET 4.0 or higher. It works by starting my C# Evaluator based on Mono.CSharp from the Mono Runtime. Node will start a child REPL process. You send C# code by writing to the child's stdin and subscribe to its stdout.
Minimal use. Define a string in C# environment.
const CSharpScriptEngine = require('mono.csharp')
let CSE = new CSharpScriptEngine()
CSE.on('data', data => {
console.log(data)
})
CSE.write('string MyName = "Jochem Stoel";')
Load assemblies programatically and inhabit their namespace.
/* IPC using CSE */
let CSE = new CSharpScriptEngine()
/* handle however you feel */
function handle(data) {
console.log(data)
}
/* sends "using $namespace" to process stdin */
CSE.using('System')
CSE.using('System.IO')
CSE.loadAssembly('MyFile.dll')
CSE.using('MyNamespace')
CSE.write('int x = 4;')
/* data is a console line */
CSE.on('data', data => {
handle(data)
})
/* initiate dialog with user/client */
CSE.REPL()
using will simply prepend "using " before line and append ";" after line before sending to stdin. Basically CSE.using('System.IO') is the same as CSE.write('using System.IO;')
/* can be written as chain */
CSE.using('System').using('System.IO').using('System.Reflection') ...
/* suggested way */
CSE.using('System.IO')
.using('System.Windows.Forms')
.loadAssembly('MyLibrary.dll')
.using('MyNameSpace')
.using('MyNameSpace.SubSpace')
.write('var MyObj = new MyObject();')
.done()
wrap child_process.stdout.on to on()
write line to CSE process stdin
initiate REPL dialog with user/client
kill the child

When CSE.exe evaluates an expression, it will stdout print "true" if it parsed correctly or "false" when you forget a semi colon or whatever. You can use this in your on.data event handler to determine what is happening.
If you want, you could prototype a method "getVar" that sends Console.WriteLine(varName.toString()) to the child process and then catch it with your handler function.
This package/module is experimental in general implementation as well as for myself. I strongly advise not to implement this in real world applications. However, if you do find a useful purpose for it or want to contribute, don't be shy and email me jochemstoel(@)gmail.com. That is after all why I publish these things in the first place.
![]()
Involuntary public figure.
FAQs
Talk C# to .NET using Node. (still under development)
We found that mono.csharp demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Malicious npm packages use Adspect cloaking and fake CAPTCHAs to fingerprint visitors and redirect victims to crypto-themed scam sites.

Security News
Recent coverage mislabels the latest TEA protocol spam as a worm. Here’s what’s actually happening.

Security News
PyPI adds Trusted Publishing support for GitLab Self-Managed as adoption reaches 25% of uploads