
Research
Security News
Lazarus Strikes npm Again with New Wave of Malicious Packages
The Socket Research Team has discovered six new malicious npm packages linked to North Korea’s Lazarus Group, designed to steal credentials and deploy backdoors.
mx-puppet-bridge
Advanced tools
This is a library for easily building puppeting bridges for matrix.
A puppeting bridge is a bridge which logs into a remote account of a service for you (puppeting) and thus allows you to use it via matrix. Matrix will basically act as a client for that remote implementation. Double-puppeting is available, but 100% optional.
In addition to puppeting mode, this library also supports a relay mode: The account of the remote protocol is used as relay bot between the remote protocol and matrix.
npm run docs
Please note that not all protocol implementations support all features. This is just a feature list of the features available in this library.
For group mapping to work the homeserver in use has to support groups and group creation. For
synapse, you need to set enable_group_creation: true
in your homeserver.yaml
. After that, in the
protocols config.yaml
set bridge.enableGroupSync
to true
.
Relay mode is a mode where the remote puppet acts as a relay bot, rather than a puppeting bot. In relay mode the display name of the author of the message on the matrix side is prepended to the message.
To activate relay mode for a puppet type settype <puppetId> relay
. If you want the rooms of said
relay to be publicly usable, type setispublic <puppetId> 1
.
Be sure to whitelist the users you want to relay, a possible config for to relay everyone could look as follows:
relay:
whitelist:
- ".*"
In order for plumbed rooms to work the protocol implementation must support global namespace and at least one puppet of relay type has to have been added. In your config you can specify who is able to create plumbed rooms. If everyone should be able to, your config could look as follows:
selfService:
whitelist:
- ".*"
After that, invite the bridge bot into the matrix room you want to bridge. Then type
!<network identifier> bridge <remote room ID>
, for example for discord !discord bridge 123456
. A
protocol implementation may add additional parsing to the remote room ID to allow multiple formats.
It can be a hassle to have to tell the bridge what your access token is to enable double-puppeting.
To circumvent that automatic double-puppeting is available. Configure your homeserver with
matrix-synapse-secret-auth and set
the secert for that homeserver in the bridge.loginSharedSecretMap
mapping.
Sent images, video and audio can have metadata added to them, for that make sure that ffprobe
is installed in your $PATH
. It usually comes bundled with ffmpeg
.
To bridge a new protocol only a small amount of features has to be implemented. For examples see the corresponding section. For a full list of available endpoints, see bridge.md.
Not all features need to be implemented by protocol implementations. Here are some features and which hooks are required to get them working:
Feature | Hooks |
---|---|
normal functionality | botHeaderMsg , getDataFromStr , getDesc |
make listusers working | listUsers |
make listrooms working | listRooms |
inject data on user creation | createUser |
inject data on room creation | createRoom |
enable group syncing | createGroup |
initiate 1:1 rooms from the matrix side | getDmRoomId , createRoom |
initiate rooms from the matrix side | createRoom |
autopopulate rooms with users | getUserIdsInRoom |
FAQs
Matrix Puppeting Bridge library
The npm package mx-puppet-bridge receives a total of 7 weekly downloads. As such, mx-puppet-bridge popularity was classified as not popular.
We found that mx-puppet-bridge demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
The Socket Research Team has discovered six new malicious npm packages linked to North Korea’s Lazarus Group, designed to steal credentials and deploy backdoors.
Security News
Socket CEO Feross Aboukhadijeh discusses the open web, open source security, and how Socket tackles software supply chain attacks on The Pair Program podcast.
Security News
Opengrep continues building momentum with the alpha release of its Playground tool, demonstrating the project's rapid evolution just two months after its initial launch.