Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
The shimmer npm package is a utility for wrapping and replacing object properties and methods, primarily used for monkey-patching - a technique to modify or extend the behavior of libraries or objects in a dynamic way. It allows developers to intercept and modify the behavior of functions in a non-intrusive manner, which is particularly useful for logging, monitoring, and testing purposes.
Wrapping a function
This code demonstrates how to use shimmer to wrap a function. It intercepts calls to the original function, allowing you to execute code before and after the original function is called.
const shimmer = require('shimmer');
function originalFunction() {
console.log('Original function');
}
shimmer.wrap(originalFunction, function(original) {
return function() {
console.log('Before original function');
original.apply(this, arguments);
console.log('After original function');
};
});
originalFunction();
Replacing a method of an object
This example shows how to use shimmer to replace a method of an object. It allows you to run custom code before and after the original method is executed, effectively modifying its behavior.
const shimmer = require('shimmer');
const myObject = {
myMethod: function() {
console.log('Original method');
}
};
shimmer.wrap(myObject, 'myMethod', function(original) {
return function() {
console.log('Before original method');
original.apply(this, arguments);
console.log('After original method');
};
});
myObject.myMethod();
Hooker is a package that provides similar functionality to shimmer, allowing for pre and post function interception. It differs in its API and the way it handles the context of the function calls, but serves a similar purpose in terms of enabling function wrapping and modification.
Proxyquire is designed for intercepting and mocking module dependencies during testing, which is a form of monkey-patching. While its primary use case is in testing scenarios to replace module dependencies, it shares the concept of intercepting and modifying behavior dynamically with shimmer.
shimmer
does a bunch of the work necessary to wrap other methods in
a wrapper you provide:
var http = require('http');
var shimmer = require('shimmer');
shimmer.wrap(http, 'request', function (original) {
return function () {
console.log("Starting request!");
var returned = original.apply(this, arguments)
console.log("Done setting up request -- OH YEAH!");
return returned;
};
});
There are times when it's necessary to monkeypatch default behavior in JavaScript and Node. However, changing the behavior of the runtime on the fly is rarely a good idea, and you should be using this module because you need to, not because it seems like fun.
All monkeypatched functions have an attribute, __wrapped
, set to true on
them.
If you pass in an options object containing a function labeled logger
,
shimmer
will use it instead of the logger, which defaults to console.error
.
shimmer
is built to be as unobtrusive as possible and has no need to run
asynchronously, so it defaults to logging when things fail, instead of
throwing.
shimmer
monkeypatches in place, so it expects to be passed an object.
It accepts either instances, prototypes, or the results of calling
require
. name
must be the string key for the field's name on the
object.
wrapper
is a function that takes a single parameter, which is the original
function to be monkeypatched. shimmer
assumes that you're adding behavior
to the original method, and not replacing it outright. If you are replacing
the original function, feel free to ignore the passed-in function.
If you aren't discarding the original, remember these tips:
original.apply(this, arguments)
,
unless your reason for monkeypatching is to transform the arguments.Just like wrap
, with the addition that you can wrap multiple methods on
multiple modules. Note that this function expects the list of functions to be
monkeypatched on all of the modules to be the same.
A convenience function for restoring the function back the way it was before you started. Won't unwrap if somebody else has monkeypatched the function after you (but will log in that case). Won't throw if you try to double-unwrap a function (but will log).
Just like unwrap
, with the addition that you can unwrap multiple methods on
multiple modules. Note that this function expects the list of functions to be
unwrapped on all of the modules to be the same.
FAQs
Safe(r) monkeypatching for JavaScript.
We found that shimmer demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.