
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
node-phpfpm
Advanced tools
node.js run php scripts via phpfpm
npm install node-phpfpm
var PHPFPM = require('node-phpfpm');
var phpfpm = new PHPFPM(
{
host: '127.0.0.1',
port: 9000,
documentRoot: __dirname
});
phpfpm.run('test.php', function(err, output, phpErrors)
{
if (err == 99) console.error('PHPFPM server error');
console.log(output);
if (phpErrors) console.error(phpErrors);
});
var phpfpm = new PHPFPM(configObject);
configObject may have the following keys:
documentRoot optional [string] the document root folder of PHP scripts. must ends with /host optional [string] the ip or host name of php-fpm server (default: 127.0.0.1)port optional [int] the port of php-fpm server ( default: 9000 )sockFile optional [string] use the unix sock file instead of 127.0.0.1:9000 to connect php-fpm serveravailable keys in options object
uri [string] path to your phpfileurl [string] alias of urimethod optional [string] GET or POST (default: GET)form optional [object] form_data that will be send with content-type: application/x-www-form-urlencodedjson optional [object] json data that will be send with content-type: application/jsonbody optional [string] raw post body datacontentType optional [string] the content-type headercontentLength optional [string] the content-length headerif you send a string as options, it will be converted to:
{ uri: "the string value", method: 'GET' }
callback
function(err, output, phpErrors)
{
// if err === 99, means php-fpm error
// it may be lost php-fpm connection or too many connections
// otherwise it will always equal to false
// output is the stdout of php scripts
// phpErrors is the php errors detail string
// php will output some errors, but that does not mean the request fails
// if you turn on display_errors in your php.ini, the phpErrors content will also be found in the output string
console.log(err, output, phpErrors);
}
Simple php request with no parameters
phpfpm.run('test1.php', function(err, output, phpErrors)
{
console.log(err, output, phpErrors);
});
Send data via GET method
phpfpm.run('test.php?a=b&c=d&e[0]=1&e[1]=2', function(err, output, phpErrors)
{
console.log(err, output, phpErrors);
});
<?php
print_r($_GET);
// Array
// (
// [a] => b
// [c] => d
// [e] => Array
// (
// [0] => 1
// [1] => 2
// )
// )
?>
Send form data via POST method
phpfpm.run(
{
uri: 'test.php',
form:
{
a:'a',
b:'b'
}
}, function(err, output, phpErrors)
{
console.log(err, output, phpErrors);
});
<?php
print_r($_POST);
// Array
// (
// [a] => a
// [b] => b
// )
?>
Send json data with POST method
phpfpm.run(
{
uri: 'test.php',
json:
{
a:'a',
b:'b'
}
}, function(err, output, phpErrors)
{
console.log(err, output, phpErrors);
});
<?php
echo file_get_contents('php://input');
// {"a":"a","b":"b"}
?>
Send form data with GET method
phpfpm.run(
{
uri: 'test2.php',
method: 'GET',
form:
{
a:'a',
b:'b'
}
}, function(err, output, phpErrors)
{
console.log(err, output, phpErrors);
});
<?php
print_r($_GET);
// Array
// (
// [a] => a
// [b] => b
// )
?>
Send form data and query string with GET method
phpfpm.run(
{
uri: 'test2.php?c=cc',
method: 'GET',
form:
{
a:'a',
b:'b'
}
}, function(err, output, phpErrors)
{
console.log(err, output, phpErrors);
});
<?php
print_r($_GET);
// Array
// (
// [c] => cc
// [a] => a
// [b] => b
// )
?>
Send raw body data with POST method
phpfpm.run(
{
uri: 'test5.php',
body: 'abc123'
}, function(err, output, phpErrors)
{
console.log(err, output, phpErrors);
});
<?php
echo file_get_contents('php://input');
// abc123
?>
MIT
This project is based on the great work of node-fastcgi-client written by LastLeaf. LastLeaf/node-fastcgi-client
FAQs
nodejs run php scripts via phpfpm
The npm package node-phpfpm receives a total of 188 weekly downloads. As such, node-phpfpm popularity was classified as not popular.
We found that node-phpfpm demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.