Research
Security News
Threat Actor Exposes Playbook for Exploiting npm to Build Blockchain-Powered Botnets
A threat actor's playbook for exploiting the npm ecosystem was exposed on the dark web, detailing how to build a blockchain-powered botnet.
process-streams
Advanced tools
Wrapper for piping data into and out of child processes
The goal of this small package is to provide a interface for streaming data to and from child-processes. It may be possible to stream data to a process via stdout and read the result from stdin, but it may also be necessary to store the data in a temporary file and provide the filename to the process as argument.
A concrete example is ffmpeg: It is possible to encode webm-videos to a stream, but h264 must always be stored in a temporary file first. On the other hand in some cases it is not possible to stream data into ffmpeg, so data must be stored in a temporary file prior to calling ffmpeg.
ProcessStreams provides the methods exec
, execFile
and spawn
from the child_process
with the same arguments.
The return value however is always a through-stream. The command line arguments are examined for occurences of
the strings <INPUT>
and <OUTPUT>
.
<INPUT>
is present, the stream input is piped into a temporary file and <INPUT>
is replaced by its filename.<OUTPUT>
is present, it is replaced by the name of a temporary file and the contents of this file is
used as stream output for the resulting stream.<INPUT>
or <OUTPUT>
are not present, the stream input is directly piped to the child processes stdin
(or the child processes stdout is piped to the stream output).Temporary files are always deleted when no longer needed.
npm install process-streams
The following examples actually only pipes data to stdout, but via child processes with different temp-file options.
const stringToStream = require('string-to-stream')
const ProcessStream = require('process-streams')
const ps = new ProcessStream()
// This basically pipes the stream as-is to stdout
// through multiple variations of process-streams
// Temporary files for input and output
stringToStream('hello\n')
.pipe(ps.exec('cp <INPUT> <OUTPUT>'))
.pipe(ps.spawn('cp', ['<INPUT>', '<OUTPUT>']))
.pipe(ps.execFile('cp', ['<INPUT>', '<OUTPUT>']))
// Stream input, use temp-file for output
.pipe(ps.spawn('tee', ['<OUTPUT>']))
// Temp-file for input, Stream for output
.pipe(ps.spawn('cat', ['<INPUT>']))
// Pipe both sides
.pipe(ps.spawn('cat'))
// Result to stdout
.pipe(process.stdout)
Output:
hello
ps.spawn(command, [args], [options])
For details about function arguments please refer to the api documentation of child_process.spawn(command, [args], [options])
ps.exec(command, [options], callback)
For details about function arguments please refer to the api documentation of child_process.exec(command, [options], callback)
ps.execFile(file, [args], [options], [callback])
For details about function arguments please refer to the api documentation of child_process.execFile(file, [args], [options], [callback])
ps.factory(useTmpIn, useTmpOut, callback)
This function uses the provided callback to connect input and output of the resulting stream. useTmpIn
and useTmpOut
are booleans that define which
parts of the stream temp should use temp files.
callback
has the signature function(input, output, callback)
. "input" and "output" are either streams of paths of temporary files. The callback must
be called when data is available for output. If "tmpUseOut" is false
, this can be called immediately. It "tmpUseOut" is true
it must be called, when the
output tempfile has completely been written to.
The tokens <INPUT>
and <OUTPUT>
can be changed:
const stringToStream = require('string-to-stream')
const ProcessStream = require('process-streams')
const ps = new ProcessStream('[IN]', '[OUT]')
stringToStream('hello\n')
.pipe(ps.exec('cp [IN] [OUT]'))
.pipe(process.stdout)
Process errors (such as not finding the executable file) are emitted on the resulting stream as 'error'
event.
The 'started'
event is emitted when the is started. Its first argument is the child-process object, second and
third arguments are the command
and args
passed to ps.exec
, ps.spawn
or ps.execFile
), but with the
placeholders resolved to the their actual temporary files.
const stringToStream = require('string-to-stream')
const ProcessStream = require('process-streams')
const ps = new ProcessStream()
stringToStream('hello\n')
.pipe(ps.spawn('cat'))
.on('error', function (err) {
// Handle errors
console.log('error', err)
})
.on('input-closed', function (err) {
// Handle ECONNRESET and EPIPE processe's stdin
console.log('input-closed', err)
})
.on('started', function (process, command, args) {
// If "ps.exec" is called, 'command' contains the whole
// resolved command and 'args' is undefined.
})
.on('exit', function (code, signal) {
// see the 'child_process' documentation for the 'exit'-event.
})
.pipe(process.stdout)
process-streams
is published under the MIT-license.
See LICENSE for details.
For release notes, see CHANGELOG.md
See CONTRIBUTING.md.
You can send me money, if you like my work:
v1.0.3
Date: 2024-07-14T13:42:53.319Z
Note: This release changes the naming pattern of temporary files from
<uuid>.in
and <uuid>.out
to ps-<timestamp>-<randomhex>.in
(and .out
)
It uses os.tmpDir()
to find the temporary directory. Please report any
problems.
FAQs
Wrapper for piping data into and out of child processes
The npm package process-streams receives a total of 0 weekly downloads. As such, process-streams popularity was classified as not popular.
We found that process-streams demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A threat actor's playbook for exploiting the npm ecosystem was exposed on the dark web, detailing how to build a blockchain-powered botnet.
Security News
NVD’s backlog surpasses 20,000 CVEs as analysis slows and NIST announces new system updates to address ongoing delays.
Security News
Research
A malicious npm package disguised as a WhatsApp client is exploiting authentication flows with a remote kill switch to exfiltrate data and destroy files.