Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
node-tunnel
Advanced tools
HTTP tunneling proxy library.
Install node-tunnel
by running:
$ npm install node-tunnel
Function that creates a connection between the tunnel and the target server.
It defaults to Promise.method(net.connect)
which returns Promise<net.Socket>
.
Kind: method of Tunnel
Summary: Establish the upstream connection.
Access: public
Example
// Create a tunnel with a custom connect method
tunnel = new Tunnel();
tunnel.connect = (port, host, client, req) => {
console.log(`Establishing tunnel to ${host}:${port}...`);
return Promise.method(net.connect);
};
Use a middleware function for rewriting request destination (by changing req.url), add authorization or filter connections to only certain hosts and ports.
The parameters are the same as the http module passes on "connect" event, plus a callback function similar to express middleware.
Keep in mind that express middleware do not work with in conjunction with this module.
Kind: method of Tunnel
Summary: Use a middleware.
Access: public
Example
// Start a tunneling proxy on port 3128
tunnel = new Tunnel();
tunnel.use( function(req, cltSocket, head, next) {
// Send all connections to port 80 of localhost.
req.url = "http://localhost:80";
next();
} );
tunnel.listen(3128)
Start listening on the given port. An optional callback function is called when tunnel is ready to listen.
Kind: method of Tunnel
Summary: Start listening.
Access: public
Example
tunnel = new Tunnel();
tunnel.listen(3128, function() {
console.log("Tunnel listening on port 3128");
});
Parses Proxy-Authorization header and sets req.auth.username and req.auth.password properties.
Further middleware should be added to accept or reject connections based on this authentication information.
Kind: method of Tunnel
Summary: Parse Proxy-Authorization header.
Access: public
Example
tunnel = new Tunnel();
tunnel.use(basicAuth);
tunnel.use( function(req, cltSocket, head, next) {
if (req.auth.username != "user" || req.auth.password != "password") {
cltSocket.end() // close connection
return; // no further middleware need to be called
}
next();
} );
tunnel.listen(3128, function() {
console.log("Tunnel listening on port 3128");
});
If you're having any problem, please raise an issue on GitHub and the Balena team will be happy to help.
Run the test suite by doing:
$ npm install && npm test
Before submitting a PR, please make sure that you include tests, and that coffeelint runs without any warning:
The project is licensed under the MIT license.
v4.0.1
FAQs
Http tunneling proxy
The npm package node-tunnel receives a total of 755 weekly downloads. As such, node-tunnel popularity was classified as not popular.
We found that node-tunnel demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.