
Security News
The Hidden Blast Radius of the Axios Compromise
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.
This script wraps a call to node in such a way that the commandline window is hidden.
It uses vbscript approach similar to this, and only works on Windows OS. Any number of arguments can be passed to the script.
The module is intended to be installed globally:
npm install -g runbg
Use like you normally would use node but type nodebg instead.
Say you have a script test_server.js (check runbg module directory) that you want to run with a port number as an argument:
nodebg test_server 8000
PID: 4340
The PID of the started process gets printed to the commandline if everything is ok.
Now the console window in which you have typed the command can be closed.
Test wether the server is running by typing http://localhost:8000/ in browser.
The server can then be stopped by killing node process with the corresponding PID in taskmanager or by command:
taskkill /PID 4340 /F
Note that if some server on the port specified is already running this won't stop new
nodeprocess from being created, sonodebg test_server 8000if ran multiple times in a row will always print new PIDs as it should. But thenodeprocess will crash due to port 8000 being occupied already. So new processes will be terminated immediately after creation and only the first server will keep running.
Runbg is a more generic version of 'nodebg' script that allows to run any commandline application in the background:
runbg node test_server 8000 some_other_argument
Check https://msdn.microsoft.com/en-us/library/aa389388(v=vs.85).aspx for process.Create errorcodes explanation.
FAQs
A script to run node modules windowless. Doesn't use daemons/services.
We found that runbg demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.