Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
sftp-uploader
Advanced tools
sftp-uploader
是一款基于ssh2-sftp-client
封装的文件上传插件,支持webpack
及vite
,可以实现将打包好的项目文件一键上传到指定的sftp服务器目录,支持集成为webpack
或vite
插件或单独
使用,支持自动创建上传目录。
$ yarn add sftp-uploader
$ npm i sftp-uploader
此版本仅适用于 node "^18.0.0 || >=20.0.0"
低版本node请下载v1.x版本
import { resolve } from 'path'
import SftpUploader from 'sftp-uploader'
const sftp = SftpUploader({
dir: resolve('./dist'), // 需要上传文件的目录
url: '******', // 上传到的目录
host: '*****', // sftp地址
port: '*****', // sftp端口
username: '*****', // 账号
password: '*****', // 密码
// 延迟上传时间(毫秒),解决部分项目会触发多次打包完成的问题
delay: 0,
// 上传文件过滤器,可以过滤掉不需要的文件,返回false将不会上传该文件(可选)
uploadFilter(file) => file.name.endsWith(.gz),
// 删除文件过滤器,可以过滤掉不需要删除的文件,返回false将不会删除该文件(可选)
deleteFilter(file) => file.name.endsWith(.gz),
// 预览链接接地址(可选)
previewPath: 'https://www.baidu.com'
})
// webpack中使用
//vue.config.js
module.exports = {
configureWebpack: config => {
return {
plugins: [
SftpUploader({ ... })
]
}
}
}
// vite中使用
//vite.config.js
export default defineConfig({
plugins: [
SftpUploader({ ... })
]
})
// package.json
// 1、window环境
"scripts": {
"build": "vue-cli-service build --mode development",
"deploy": "set UPLOAD=true && yarn build"
}
// 2、liunx or macos环境
"scripts": {
"build": "vue-cli-service build --mode development",
"deploy": "export UPLOAD=true && yarn build"
}
// 使用 yarn deploy 或 npm run deploy
// 1、在项目中创建uploader.js
// 2、配置和webpack插件模式相同
SftpUploader({ ... }).put()
// 然后在项目根目录终端下运行如下命令
node uploader.js
FAQs
sftp-uploader
We found that sftp-uploader demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 5 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.