
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
osx-keylogger
Advanced tools
By using native bindings to IOKit we can talk directly with the keyboard. Unfortunately this means we have to provide our own key layouts but since we can talk directly with the hardware this should work regardless of which state the rest of the system is in.
I've noticed that this is my most popular package so feel free to help out. Here is some examples of what I could use some help with:
osx-keylogger.cc and suggest improvements(by creating issues) or make pull requests to improve it.Anything missing or poorly designed, let me know. I built this as a POC and will only continue to work on it provided that I get feedback from the community.
macOS Catalina 10.15.3
Since the writing of this library OS X now has added security features to let the user allow/deny direct recording of keystrokes.
When I tested this I found it to work for versions of node between 8 and 11
Building this package requires XCode to be installed for Catalina, I am unsure if that was needed for previous versions of OSX.
const keylogger = require('osx-keylogger');
// shows only the stuff from the keylogger(not stdin) but breaks ctrl+c
// process.stdin.setRawMode(true);
let currentModifiers = '';
keylogger.listen((modifiers, key) => {
if (modifiers !== currentModifiers) {
currentModifiers = modifiers;
process.stdout.write(`[${modifiers}]`);
}
process.stdout.write(key);
}, 'swedish.json');
This example uses the swedish.json file as the key layout and will write the users input to stdout.
By running the command
node makeKeylayout.js yourlanguage.json
And then using the console you are running it in to read what keys are pressed you can create your own language key layout. In this case it would create yourlanguage.json
via npm
npm install osx-keylogger
Sorry, I didn't feel like it. It's a POC
I couldn't find a decent opensource keylogger for a modern version of OS X and I was looking for an excuse to try out native bindings.
MIT, see LICENSE file
FAQs
Mac OS X 10.5+ Keylogger POC
We found that osx-keylogger demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.