Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
This is a simple wrapper to Angus Croll's typeOf
function defined in his article Fixing the Javascript typeof operator.
Additionally, it includes a subsequent test to determine whether a function is a functional prototype, and therefore something that would be suitable for calling with the new
operator. A value of prototype
is returned from the function in event that:
function
through Angus's previous logicprototype
of the function has some keys defined on it. While this is not a conclusive test (suggestions definitely welcome) I think it covers most of the cases where people are using JS prototypes in their code.A small helper has been added to sniff to assist with the process of determining the function signature that a function has been called with. This code was written to help with those cases where you have a function that might be called with a variety of different combinations and permutations.
In simple cases, while you might do something like the following:
function example(name, opts, callback) {
if (typeof opts == 'function') {
callback = opts;
opts = {};
}
// rest of your function here
}
This can get tiresome and somewhat error prone when you have more complicated functions. This is where the sniff.args
helper can come in handy. For example, this next function is designed to be called with just a name, or a name and an age, or name, age and callback, etc, etc. While writing a function like this would probably generally be discouraged in JS every now and again they are needed.
Anyway, let's take a look:
function example(name, age, opts, callback) {
// first analyse the arguments and get a matcher function
var matchSig = sniff.args(arguments);
// check for the name, age and callback case
if (matchSig('string', 'number|string', 'function')) {
// remap opts
callback = opts;
opts = {};
}
// or the name, opts, function case
else if (matchSig('string', 'object', 'function')) {
// remap age, opts, and the callback
callback = opts,
opts = age;
age = null;
}
}
FAQs
JS Type and Prototype Sniffing
We found that sniff demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.