Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Small SMTP server that can take incoming emails and send them to an API that you specify.
$ npm install -s smtp2api
I wanted a way to take emails and forward them in an easy to consume format to an API. At the time of building I didn't find any good tools that supported this use case so figured building a lightweight SMTP server to do it for me would be the easiest way to go.
In particular you can setup this server on a publically facing machine, create an MX DNS record pointing to it, and send emails to an email on that domain to forward those emails to an API.
If you already have an email provider like O365 or GSuite that is wired up to your domain and you would like this to only apply to emails sent to a specific email address, you can solve this by setting up an MX record on a sub domain and auto forward emails from the email address on your main domain to any email address on your smtp2api server.
For example, if you want to send emails sent to noreply@mydomain.com
to an API using smtp2api and mydomain.com is already using GSuite, you could setup an MX record for the subdomain smtp2api.mydomain.com
pointing to your smtp2api server, autoforward emails sent to noreply@mydomain.com
to noreply@smtp2api.mydomain.com
in GSuite, and those emails would now go to your API.
With the small script below you can use HELO, EHLO, or any other
email client to send an email to your API listening locally
on port 8000 as JSON with HTTP header Content-type: application/json
.
import SMTP2API from 'smtp2api'
const port = 25
const smtp = SMTP2API({ endpoint: `http://localhost:8000/my/api` })
smtp.startServer(port)
console.log(`listening on *:${port}`)
$ npm install -g smtp2api
$
$ # start SMTP server listening on port 25 that
$ # sends emails to an API on localhost:8000
$ smtp2api -e http://localhost:8000/my/api -p 25
listening on *:25
$ git clone https://github.com/whatl3y/smtp2api
$ cd smtp2api
$ docker build -t smtp2api .
$ docker run -e SMTP2API_ENDPOINT=http://localhost:8000/my/api -e PORT=25 smtp2api
import SMTP2API from 'smtp2api'
const smtp = SMTP2API(opts) // opts: SMTP2APIOptions
smtp.startServer(port) // port: number (default: 25)
console.log(`listening on *:${port}`)
If you'd like to test your SMTP server against a small API to see what the output looks like, we ship an API server that you can use to log the output of an incoming email.
$ # Start a simple API server you can send emails to any route
$ # that will listen in port 8080
$ #
$ # use `$ smtp2api -e http://localhost:8080/test` to pass emails
$ # to this server.
$ npx smtp2apiApiServer
FAQs
Send emails from an SMTP server to your own API.
The npm package smtp2api receives a total of 0 weekly downloads. As such, smtp2api popularity was classified as not popular.
We found that smtp2api demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.