
Security Fundamentals
Turtles, Clams, and Cyber Threat Actors: Shell Usage
The Socket Threat Research Team uncovers how threat actors weaponize shell techniques across npm, PyPI, and Go ecosystems to maintain persistence and exfiltrate data.
native-calls
Advanced tools
Native Calls allows developers to write IDL files that get compiled into C++ and JavaScript stubs that implement RPC calls over postMessage
.
The result is a nice, clean way of using Native Code straight from JavaScript!
Part of my final year project at Imperial College London.
This is still work in progress, but feedback is much appreciated!
Please read the getting started guide to see how Native Calls works and how to use it.
To build the project, you'll need the following requirements:
To build, simply run make
in this folder. This will get JavaScript dependencies, build the C++ RPC library and build each individual demo.
Note: I have only tested this on Mac OSX and linux. Compiling on Windows will probably break.
To see it in action, make sure you have built the project (see above). Then, type make serve
. This will start a server in the project directory.
Visit the index page, by typing http://localhost:3000/ into your browser.
To install the C++ library to your SDK, run make install
.
This will build the library for all toolchains and configurations.
This will also install the generator, pprpcgen
globally.
If you want to only install pprpcgen
without cloning this repository, you can type npm install -g native-calls
.
To run all tests, type make test
. This will test JavaScript front end, back end (generators), and C++ tests.
You can also test each component individually:
make test
runs all testsmake nodetest
runs generator testsmake cpptest
runs C++ rpc framework testsmake eetest
runs end-to-end testsmake jstest
runs JavaScript rpc framework testsThe tests are run using karma.
If you're interested in contributing, here are some things that still need to be done...
You can read some design docs in the docs folder.
The full project report (in progress) is written in TeX and is found in the report repo.
How to set up the Native Calls project in Eclipse.
A project has already been created and is in the repository. All you need to do is to configure it with your NACL_SDK_ROOT
.
.cproject.sample
file and save it as .cproject
.File
-> Import...
-> Existing Project into Workspace
C/C++ Build
-> Enivronment
, set the NACL_SDK_ROOT
variable to be the NaCl SDK location. Save for all configurations.C/C++ Build
-> Build Variables
, set the NACL_SDK_ROOT
variable to be a directory pointing to your NaCl SDK location. Save for all configurations.Index
-> Rebuild
to rebuild the index.make
.You can also set up eclipse to debug the C/C++ application. This is shown in the chromium how-to.
FAQs
A JavaScript - C++ RPC library generator
The npm package native-calls receives a total of 2 weekly downloads. As such, native-calls popularity was classified as not popular.
We found that native-calls demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security Fundamentals
The Socket Threat Research Team uncovers how threat actors weaponize shell techniques across npm, PyPI, and Go ecosystems to maintain persistence and exfiltrate data.
Security News
At VulnCon 2025, NIST scrapped its NVD consortium plans, admitted it can't keep up with CVEs, and outlined automation efforts amid a mounting backlog.
Product
We redesigned our GitHub PR comments to deliver clear, actionable security insights without adding noise to your workflow.