Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Universal package installer, get the command for managing packages, or auto install any package, using one command for all platforms. Automate the installation of macOS Brew, and Windows Chocolatey package managers. A promisify child process of spawn, and
Universal package installer, get the command for managing packages, or auto install any package, using one command for all platforms. E.g.
sudo apt-get install
!@#$software for Debian-based systems, would benode-sys
!@#$software.
This is mainly focused on initial installation of an Node JS packages that needs additional host software installed. This allows pre and post script install routines. Can also automate the installation of macOS Brew, and Windows Chocolatey package managers.
node-sys
will try to find which system packaging is installed for the given process.platform
. If no system package manager is found, 'No package manager found!'
is returned.
A spawning
cross-platform version of Node's child_process.spawn
that returns a Promise, with additions:
Windows
a pop up UAC window will appear.stderr
and stdout
on data
events, any returns will be the reject/resolve result.fork
another script, a Node Js module instance, for additional sub processing base on stderr
or stdout
events.
message
event.A series of general use case strick
type checkers.
npm install node-sys
import { packager } from 'node-sys';
/**
* Gets the system package manager install command.
*
* - 'brew install' on OS X if homebrew is installed.
* - 'sudo apt-get install' on debian platforms.
* - 'sudo yum install' on red hat platforms.
* - 'System OS package manager not found' if no package manager is found.
*
* Throws if `process.platform` is none of darwin, freebsd, linux, sunos or win32.
*/
const sys = packager();
console.log('Do system OS require sudo? ' + sys.sudo);
console.log('The system OS install command: ' + sys.command);
console.log('To fully install a `pandoc` package run: ' + sys.installer + ' pandoc');
vim
package onto host, using system's default package managerPromise
import { installer } from 'node-sys';
// Progress callback for any output doing installation.
// Any value returned in `callback` will be the final resolved output result.
const onprogress = (object) => {
console.log(object.output);
}
installer('vim', onprogress)
.then(function(data){
// returns installation output
console.log(data);
})
.catch(function(err) {
console.log(err);
});
spawning
(command, arguments, progressOptions, options)import { spawning } from 'node-sys';
Spawning
takes an additional argument, progressOptions
, its options
are the same as those of child_process.spawn
plus:
sudo: boolean, // run as administrator
fork: string, // execute an additional module, of Node Js process `fork` IPC communication channel.
onerror: callable, // callback for `stderr.on('data')` event.
onprogress: callable, // callback for `stdout.on('data')` event.
onmessage: callable, // callback for `on('message')` for `fork` event.
Spawning
returns a promise whose result will be any output or any data return in the progress callback.
The progress callback will receive an object with these properties:
spawn:
Object - Spawned child process instance handle.
output:
String - Output from stdout.
fork:
Object - An additional forked Node Js process handle, IPC communication channel.
If there's an error running the child process, received data on stderr, or errors in progress callback, spawning
rejects the returned promise.
strict
type check
functionsimport {
isArray, // True if value is an Array, otherwise false.
isUndefined, // True if the value is undefined, otherwise false.
isBuffer, // True if value is a Buffer, otherwise false.
isArrayBuffer, // True if value is an ArrayBuffer, otherwise false.
isString, // True if value is a String, otherwise false.
isNumber, // True if value is a Number, otherwise false.
isObject, // True if value is an Object, otherwise false.
isObjectOnly, // True if value is a `Object` only, otherwise false, not an Array, Function, or any other type.
isBlob, // True if value is a Blob, otherwise false.
isFunction, // True if value is a Function, otherwise false.
isDate, // True if value is a Date, otherwise false.
isStream, // True if value is a Stream, otherwise false.
isNull, // True if value is a null, otherwise false.
isBool, // True if value is a boolean, otherwise false.
isWindows, // True if platform a Windows OS, otherwise false.
isLinux, // True if platform a Linux OS, otherwise false.
isMac, // True if platform a Apple macOS, otherwise false.
} from 'node-sys';
The sync
from node-which has been exported to where
.
import { where } from 'node-sys';
// Like the unix `which` utility, will be a `string`, or `null` for not found.
let found = where('node');
require
like before in ESMimport { require } from 'node-sys';
const package = require('package');
npm i -g node-sys
To display your system package manage command.
$ node-sys
brew install
To actually install an system package.
$ node-sys vim
installing...
To install an System OS package manager.
$ node-sys -g | --get # or npm run get-installer
...
FAQs
Universal package installer, get the command for managing packages, or auto install any package, using one command for all platforms. Automate the installation of macOS Brew, and Windows Chocolatey package managers. A promisify child process of spawn, and
The npm package node-sys receives a total of 271 weekly downloads. As such, node-sys popularity was classified as not popular.
We found that node-sys demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.