
Research
/Security News
Malicious npm Packages Target WhatsApp Developers with Remote Kill Switch
Two npm packages masquerading as WhatsApp developer libraries include a kill switch that deletes all files if the phone number isn’t whitelisted.
一个使用 Node.js 编写的反向代理服务器。
极简风格,支持 HTTPS,支持端口配置,支持子域名、多域名和多服务器。
$ npm install -g nrp
or
$ sudo npm install -g nrp
为了访问配置文件,需要知道 Node.js 环境的全局模块安装路径。
$ echo $NODE_PATH # 查看环境变量
$ npm root -g # 查看全局模块路径
$ npm get prefix # 查看 prefix
$ NRP_PATH=`npm root -g` # 设置 nrp 路径环境变量
假设需要代理服务器运行在 80 端口,www 主站和 blog 子站分别运行在本机端口 3000 和端口 4000,配置文件如下:
$ vi $NRP_PATH/nrp/config.json
{
"port": 8080,
"ssl": false,
"key": "nrp-key.pem",
"cert": "nrp-cert.pem",
"www.name.com": {
"host": "127.0.0.1",
"port": 3000
},
"blog.name.com": {
"host": "127.0.0.1",
"port": 4000
}
}
提示:HTTP 服务缺省端口是 80,HTTPS 是 443。使用 80 或 443 端口需要 sudo 权限。
为支持 HTTPS,需要 SSL 密钥文件,nrp 内置了自签名的 SSL 密钥文件。使用浏览器访问自签名 https 网站,需要选择信任。
可以修改配置文件 config.json 使用自己的密钥,也可以使用 openssl 重新生成自签名密钥。方法如下:
$ openssl genrsa -out nrp-key.pem 1024
$ openssl req -new -key nrp-key.pem -out nrp-cert.csr
$ openssl x509 -req -in nrp-cert.csr -signkey nrp-key.pem -out nrp-cert.pem
注意:密钥文件的位置,实际路径是 $NRP_PATH/nrp/lib/
。
$ nrp
or
$ sudo nrp
简单 control + c 即可退出。
可以使用 upstart 将 nrp 配置为系统服务,操作如下:
$ sudo vi /etc/init/nrp.conf
start on runlevel [2345]
stop on shutdown
respawn # 自动重启
respawn limit 10 10 # 尝试10次,间隔10秒
script
nrp 2>&1 >> /dev/null
end script
查看、启动或停止服务命令如下:
$ sudo status nrp # 查看状态
$ sudo start nrp # 启动服务
$ sudo stop nrp # 停止服务
MIT
FAQs
A reverse proxy written with node.js
The npm package nrp receives a total of 1 weekly downloads. As such, nrp popularity was classified as not popular.
We found that nrp demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
Two npm packages masquerading as WhatsApp developer libraries include a kill switch that deletes all files if the phone number isn’t whitelisted.
Research
/Security News
Socket uncovered 11 malicious Go packages using obfuscated loaders to fetch and execute second-stage payloads via C2 domains.
Security News
TC39 advances 11 JavaScript proposals, with two moving to Stage 4, bringing better math, binary APIs, and more features one step closer to the ECMAScript spec.