
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
serial-tcp-proxy
Advanced tools
Table of Contents generated with DocToc
TCP Proxy on specific serial port.
(Raw mode with 10ms as queued interval)
For the users installed serial-tcp-proxy before v0.5.0, please perform following steps to upgrade carefully, because the logging library pino was upgraded to v7 with breaking changes:
git pullrm -rf node_modulesnpm installRun the proxy server with following arguments:
stp start <filepath> [<assetDir>]
startup a tcp proxy server on the serial port with specified path
Options:
--version Show version number [boolean]
--help Show help [boolean]
-p, --port the port number for tcp proxy server to listen
[required] [default: 8080]
-b, --baud baud rate for opening serial port [required] [default: 9600]
-d, --databits data bits [required] [default: 8]
-y, --parity parity [required] [default: "none"]
-s, --stopbits stop bits [required] [default: 1]
-v, --verbose verbose output [boolean] [required] [default: false]
-r, --raw raw mode, no byline parsing
[boolean] [required] [default: false]
-q, --queued buffered data for X milliseconds before emitting, only for raw
mode. 0 indicates to disable this feature, and mimimal value
for X is 5ms [required] [default: 0]
-c, --capture enable catprue mode to record serial transmission data, might
be none, serial, tcp, or both [default: "none"]
Examples:
stp start /dev/tty.usbmodem1462103 run tcp proxy server at default port 8080,
and relay the traffic of serial port at
path /dev/tty.usbmodem1462103
Not enough non-option arguments: got 0, need at least 1
Run the proxy server to listen to tcp port 3000, and communicate with serial port /dev/tty.usbmodem1462103 with default baudrate 9600:
./index.js start -p 3000 /dev/tty.usbmodem1462103
Run the proxy server to listen to default tcp port 8080, and communicate with serial port /dev/tty.SLAB_USBtoUART with specified baudrate 115200, and treat it as RAW mode (instead of LINE mode by default), no queued data:
./index.js start -r -b 115200 /dev/tty.SLAB_USBtoUART

All received data (from either serial or tcp) are emitted immediately without any delay. Above picture shows more than 1 byte are coming even within 1 millisecond.
Run the proxy server to listen to default tcp port 8080, and communicate with serial port /dev/tty.SLAB_USBtoUART with specified baudrate 115200, and treat it as RAW mode (instead of LINE mode by default), queued data with 10ms timer interval:
./index.js start -r -q 10 -b 115200 /dev/tty.SLAB_USBtoUART

All received data from either serial or tcp are queued in a buffer for 10ms and then emitted entire buffer once.
Run the proxy server to listen to default tcp port 8080, and communicate with serial port /dev/tty.SLAB_USBtoUART with specified baudrate 115200 in RAW mode, and capture both tcp/serial data in /tmp directory with TSV format
./index.js start -r -c both -b 115200 /dev/tty.SLAB_USBtoUART
The captured data are stored in /tmp/serial-tcp-proxy-[epoch].tsv, for example /tmp/serial-tcp-proxy-1647631866732.tsv. And the format of the captured data looks like following text:
# start: Sat Mar 19 2022 04:04:30 GMT+0800 (Taipei Standard Time)
! 0000000000.132 => 009200D800FF00FF
! 0000000000.180 => FF
! 0000000000.181 => 14AA0000000411
! 0000000000.182 => 103400E28011700000021390
! 0000000000.184 => C2E418968E6AD8
! 0000000000.187 => FF14AA0000000411103400E28011700000021390C2E41677406AD8
! 0000000000.213 => FF
! 0000000000.214 => 14AA0000000411103400E280
! 0000000000.215 => 11700000021390C2E41896
! 0000000000.216 => 8E6AD8
! 0000000000.222 => FF
! 0000000000.222 => 14AA000000041110
! 0000000000.223 => 3400E28011700000021390
! 0000000000.224 => C2E41547236AD8
! 0000000000.226 => FF
! 0000000000.227 => 14AA0000000411
! 0000000000.228 => 103400E280117000000213
! 0000000000.229 => 90C2E41677406AD8
! 0000000000.335 => FF14AA00
! 0000000000.336 => 00000411103400E2801170
! 0000000000.338 => 0000021390C2E41677406AD8
! 0000000000.343 => FF
...
! 0000000000.899 => FF
! 0000000000.901 => 14AA0000000411103400E2801170000002
! 0000000000.902 => 1390C2E41677406AD8
! 0000000000.909 => FF
! 0000000000.910 => 14AA0000000411103400E280
! 0000000000.910 => 11700000021390C2E4154723
! 0000000000.911 => 6AD8
! 0000000000.939 => FF
! 0000000000.941 => 14AA0000000411103400E28011700000021390C2E418968E
! 0000000000.942 => 6AD8
! 0000000001.047 => FF
! 0000000001.047 => 14AA0000000411103400E2
! 0000000001.048 => 8011700000021390C2E415
! 0000000001.049 => 47236AD8
! 0000000001.053 => FF
! 0000000001.053 => 14AA0000000411
! 0000000001.054 => 103400010300164263992002
! 0000000001.055 => 400000EE286AD8
! 0000000001.076 => FF
...
It's a SPACE-separatd format, with 4 columns:
prefix, the single character to indicate the type of packet in current line
!, streaming data packet#, comment packetuptime, the uptime since the recording was started. Please note the milliseconds are separted by dot .direction, the data direction
=>, the data from serial port (to tcp connections)<=, the dtaa to serial port (from tcp connections)hexes, the data buffer represented in hexadecimal formatFAQs
TCP Proxy on specific serial port
We found that serial-tcp-proxy demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.