
Research
Malicious npm Packages Impersonate Flashbots SDKs, Targeting Ethereum Wallet Credentials
Four npm packages disguised as cryptographic tools steal developer credentials and send them to attacker-controlled Telegram infrastructure.
﷽
Stream residue server logs via various hooks
npm install -g resitail
sudo resitail --config <config>
Notice the sudo
, this is because all the files written by residue server will need sudo access as they may be owned by one user or another with limited permissions. Resitail needs to be able to read all of these log files.
A configuration file looks like:
{
"residue_config" : "<residue-config>",
"hooks": [
... <see Connecting Hooks section below>
]
}
Hook is essentially a JS module with following minimal requirements
data
parameter.Once connected resitail will use this send
function to send the logs
A most commonly used hook is resitail-f. It is even used in production servers for muflihun.com
Example:
"use strict";
function sampleHook (options) {
this.options = options;
this.send = (data) => {
console.log(data);
}
}
module.exports = (options) => new sampleHook(options);
Data contains following properties:
Property | Description |
---|---|
event | Event name (i.e, resitail:line , resitail:err ) |
event_type | Type of event (i.e, info , error ) |
line | Contents of event (either log line or error details etc) |
channel | Type of channel (i.e, client or logger ) |
channel_name | Name of channel (i.e, client_id or logger_id ) |
logger_id | Logger ID if channel is client |
client_id | Client ID if channel is logger |
Once hook is ready you can connect it by adding it to configuration.
{
"name": "<hook name>",
<path or package>
"enabled": false,
"config": {
"channels" : {
"to_client" : true,
"to_logger" : true
}
... more configs specific to hook
}
}
A fully working hook configuration looks like:
From registry (notice package
and version
):
{
"name": "resitail-f",
"package": "resitail-f",
"version": "latest"
"enabled": true,
"config": {
"channels" : {
"to_client" : true,
"to_logger" : true
}
port: 3000
}
}
This will install the package globally.
Local (notice path
):
{
"name": "resitail-f",
"path": "../resitail-f",
"enabled": true,
"config": {
"channels" : {
"to_client" : true,
"to_logger" : true
}
port: 3000
}
}
Copyright 2017-present Zuhd Web Services
Copyright 2017-present @abumusamq
https://github.com/zuhd-org/
https://muflihun.com/
https://zuhd.org
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
FAQs
Stream your residue server logs using hooks
We found that resitail demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Four npm packages disguised as cryptographic tools steal developer credentials and send them to attacker-controlled Telegram infrastructure.
Security News
Ruby maintainers from Bundler and rbenv teams are building rv to bring Python uv's speed and unified tooling approach to Ruby development.
Security News
Following last week’s supply chain attack, Nx published findings on the GitHub Actions exploit and moved npm publishing to Trusted Publishers.