
Research
Two Malicious Rust Crates Impersonate Popular Logger to Steal Wallet Keys
Socket uncovers malicious Rust crates impersonating fast_log to steal Solana and Ethereum wallet keys from source code.
request-swish
Advanced tools
This is an axios based swish client used to make SWISH communications with a server that implements the same protocol. For the core SWISH Protocol project, please refer to https://github.com/adonisv79/swish-protocol
To install, run the following in your client project
npm i request-swish --save
Note that this project uses requet and request-promise so you may need to install thier respective @types (if you use typescript).
npm i @types/request @types/request-promise --save
Lets create a new instance of the client
import RequestSwishClient, { HTTPRequestConfig } from 'request-swish';
const SERVER_URL = 'http://localhost:3000';
const httpStartHandshake: HTTPRequestConfig = {
method: 'POST',
url: `${SERVER_URL}/auth/handshake`,
}
const httpKillHandshake: HTTPRequestConfig = {
method: 'DELETE',
url: `${SERVER_URL}/auth/handshake`,
}
const swishClient = new RequestSwishClient(httpStartHandshake, httpKillHandshake);
The RequestSwishClient requires 2 parameters of type HTTPRequestConfig which is just an object containing the method and uri where the target swish server may have their handshake 'init' and 'kill' reside. Note that these endpoints may also not exist depending on the implementation of the service.
the client has 3 main functions
swishClient.establishHandshake();
swishClient.releaseHandshake();
swishClient.sendSwish();
Let's implement these and start sending calls. we will add the following codes
async function testHandShake(): Promise<boolean> {
try {
console.log('Starting handshake...')
const r = await swishClient.establishHandshake()
console.log(`Handshake completed! your session_id is ${swishClient.SessionId}`)
console.log(r.swishResponse)
return true
} catch (err) {
console.log(err.message)
}
return false
}
async function testRequest(path: string, data: Record<string, unknown>) {
try {
console.log(`Sending request ${JSON.stringify(data)}`)
const r = await swishClient.sendSwish({
method: 'POST',
responseType: 'json',
url: `${SERVER_URL}/${path}`,
data,
})
console.log(r.swishResponse)
} catch (err) {
console.log(err.message)
}
}
async function testDestroySession() {
console.log('Destroying handshake session...')
const r = await swishClient.releaseHandshake()
console.log(r.swishResponse)
}
async function test() {
try {
await testHandShake()
// now lets start communicating to the secured endpoints
await testRequest('test/success', { action: 'hello', message: 'Adonis Villamor', passcode: 'whoami' })
// send a different one this time
await testRequest('test/success', { action: 'move', message: 'Japan', passcode: 'whereami' })
// destroy the session
await testDestroySession()
// try an illegal access now session is destoryed
await testRequest('test/success', { action: 'move', message: 'Japan', passcode: 'whereami' })
} catch (err) {
console.error(err.message)
}
}
test();
Execute the code while running the sample server from the tools in https://github.com/adonisv79/swish-protocol
FAQs
Request client utilizing the swish protocol
The npm package request-swish receives a total of 2 weekly downloads. As such, request-swish popularity was classified as not popular.
We found that request-swish demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Socket uncovers malicious Rust crates impersonating fast_log to steal Solana and Ethereum wallet keys from source code.
Research
A malicious package uses a QR code as steganography in an innovative technique.
Research
/Security News
Socket identified 80 fake candidates targeting engineering roles, including suspected North Korean operators, exposing the new reality of hiring as a security function.