
Research
Security News
Lazarus Strikes npm Again with New Wave of Malicious Packages
The Socket Research Team has discovered six new malicious npm packages linked to North Korea’s Lazarus Group, designed to steal credentials and deploy backdoors.
sftp-uploader
Advanced tools
sftp-uploader
是一款基于ssh2-sftp-client
封装的文件上传插件,支持webpack
及vite
,可以实现将打包好的项目文件一键上传到指定的sftp服务器目录,支持集成为webpack
或vite
插件或单独
使用,支持自动创建上传目录。
$ yarn add sftp-uploader
$ npm i sftp-uploader
const path = require('path')
const SftpUploader = require('sftp-uploader')
const sftp = SftpUploader({
dir: path.join(__dirname, 'dist/'), // 需要上传文件的目录
url: '******', // 上传到的目录
host: '*****', // sftp地址
port: '*****', // sftp端口
username: '*****', // 账号
password: '*****', // 密码
// 延迟上传时间(毫秒),解决部分项目会触发多次打包完成的问题
delay: 0,
// 上传文件过滤器,可以过滤掉不需要的文件,返回false将不会上传该文件(可选)
uploadFilter(file) => file.name.endsWith(.gz),
// 删除文件过滤器,可以过滤掉不需要删除的文件,返回false将不会删除该文件(可选)
deleteFilter(file) => file.name.endsWith(.gz),
// 预览链接接地址(可选)
previewPath: 'https://www.baidu.com'
})
// webpack中使用
//vue.config.js
module.exports = {
configureWebpack: config => {
return {
plugins: [
SftpUploader({ ... })
]
}
}
}
// vite中使用
//vite.config.js
export default defineConfig({
plugins: [
SftpUploader({ ... })
]
})
// package.json
// 1、window环境
"scripts": {
"build": "vue-cli-service build --mode development",
"deploy": "set UPLOAD=true && yarn build"
}
// 2、liunx or macos环境
"scripts": {
"build": "vue-cli-service build --mode development",
"deploy": "export UPLOAD=true && yarn build"
}
// 使用 yarn deploy 或 npm run deploy
// 1、在项目中创建uploader.js
// 2、配置和webpack插件模式相同
SftpUploader({ ... }).put()
// 然后在项目根目录终端下运行如下命令
node uploader.js
FAQs
sftp-uploader
The npm package sftp-uploader receives a total of 24 weekly downloads. As such, sftp-uploader popularity was classified as not popular.
We found that sftp-uploader demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 5 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
The Socket Research Team has discovered six new malicious npm packages linked to North Korea’s Lazarus Group, designed to steal credentials and deploy backdoors.
Security News
Socket CEO Feross Aboukhadijeh discusses the open web, open source security, and how Socket tackles software supply chain attacks on The Pair Program podcast.
Security News
Opengrep continues building momentum with the alpha release of its Playground tool, demonstrating the project's rapid evolution just two months after its initial launch.