
Research
Shai-Hulud Descends to Hades: Miasma Worm Campaign Spreads with New PyPI Wave
Socket found 37 malicious PyPI wheels that abuse Python startup hooks to launch a Bun-powered credential stealer tied to Mini Shai-Hulud/Miasma.
server-file-sync
Advanced tools
把本地文件夹下的文件同步到服务器指定目录下,方便前端更新代码
npm i server-file-sync -g 全局安装
在项目目录下执行 sfs -i 生成配置文件,然后按照里面的选项配置
然后就能执行 sfs 同步文件了
sfs -h 查看所有命令和使用方式
建议通过 ssh 密钥的连接方式,因为这个是最安全的,如果直接用密码连接万一泄露了就麻烦了。
如果只指定了密钥没配置密钥密码的话会再次提示输入密码的,所以最好不要把密码也写到配置文件中
首先在某个目录下执行 ssh-keygen -f 生成一对密钥(期间会提示你输密码),不带 pub 的是私钥带 pub 的是公共密钥,你要把公钥的内容添加到服务器的/root/.ssh/authorized_keys 文件中,然后把私钥和对应的密码添加进本工具的配置文件中(具体字段见配置文件),这时就能连接到服务器并同步文件了。
/**
* 配置文件类型
*/
import { Matcher } from "anymatch";
import { Client, ConnectConfig } from "ssh2";
/** 基础连接配置 */
export type TConnectConfig = Pick<
ConnectConfig,
"host" | "port" | "username" | "passphrase" | "privateKey"
>;
/**
* 配置文件类型
* TODO 关于ssh2配置信息的合并顺序是先connectConfig中的字段,再是配置文件中的字段,,再是syncList中的字段
*/
export type TConfig = TConnectConfig & {
/** 同步列表 */
syncList?: ({
/** key */
key: string;
/** 标题 */
title: string;
/** 路径列表 */
paths: {
/** 本地地址 */
local: string;
/** 远程地址 */
remote: string;
/** 文件忽略,请注意不支持 Windows 样式的反斜杠作为分隔符*/
ignored?: Matcher;
}[];
/** 开始同步之前的回调 */
beforeF?: (connF: () => Promise<Client>) => Promise<void>;
/** 同步之后的回调 */
laterF?: (connF: () => Promise<Client>) => Promise<void>;
} & TConnectConfig)[];
/** ssh2的连接配置 */
connectConfig?: ConnectConfig;
/** 是否监听 */
watch?: boolean;
/** 开始同步之前的回调 */
beforeF?: (connF: (op?: TConnectConfig) => Promise<Client>) => Promise<void>;
/** 同步之后的回调 */
laterF?: (connF: (op?: TConnectConfig) => Promise<Client>) => Promise<void>;
};
建议使用方法 getConfig 获取 config,这样就有全类型提示了,该方法的声明如下
function getConfig(f: () => TConfig | Promise<TConfig>);
使用方法如下
const { getConfig } = require("server-file-sync");
/**
* server-file-sync 的默认配置文件
*/
module.exports = getConfig(() => {
// 可以是异步的
return {
...
};
});
FAQs
The npm package server-file-sync receives a total of 3 weekly downloads. As such, server-file-sync popularity was classified as not popular.
We found that server-file-sync demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Socket found 37 malicious PyPI wheels that abuse Python startup hooks to launch a Bun-powered credential stealer tied to Mini Shai-Hulud/Miasma.

Security News
RubyGems and Bundler 4.0.13 introduced an opt-in cooldown feature that delays newly published gems during dependency resolution.

Security News
pnpm 11.5 now recognizes npm staged publish approvals in release metadata, preventing those releases from being mistaken for lower-trust package publishes.