
Research
Security News
Lazarus Strikes npm Again with New Wave of Malicious Packages
The Socket Research Team has discovered six new malicious npm packages linked to North Korea’s Lazarus Group, designed to steal credentials and deploy backdoors.
spawn-wrap
Advanced tools
Wrap all spawned Node.js child processes by adding environs and arguments ahead of the main JavaScript file argument.
The spawn-wrap npm package is used to wrap child_process.spawn calls, allowing for modifications to the environment, arguments, and executable used in child processes. This is particularly useful for instrumenting child processes or modifying their behavior in a consistent way across a project.
Environment Variable Modification
This feature allows you to prepend command line options to node processes, enabling features like harmony in all spawned child processes.
const wrap = require('spawn-wrap');
wrap(['--harmony']);
require('child_process').spawn('node', ['script.js']);
Executable Wrapping
This feature allows you to specify a custom executable (like a different version of Node.js) to be used for all child processes.
const wrap = require('spawn-wrap');
const wrappers = ['/path/to/custom/node'];
wrap(wrappers);
require('child_process').spawn('node', ['script.js']);
cross-spawn is similar to spawn-wrap in that it also enhances the functionality of child_process.spawn. However, cross-spawn focuses more on cross-platform compatibility, ensuring that spawned processes work similarly across different operating systems, unlike spawn-wrap which focuses on wrapping and modifying spawn calls.
forever-monitor is a package that deals with managing and monitoring multiple child processes. While it provides some overlapping functionality with spawn-wrap in terms of managing child processes, its primary focus is on keeping these processes running continuously, which is different from the modification and instrumentation focus of spawn-wrap.
Wrap all spawned Node.js child processes by adding environs and arguments ahead of the main JavaScript file argument.
Any child processes launched by that child process will also be wrapped in a similar fashion.
This is a bit of a brutal hack, designed primarily to support code
coverage reporting in cases where tests or the system under test are
loaded via child processes rather than via require()
.
It can also be handy if you want to run your own mock executable instead of some other thing when child procs call into it.
var wrap = require('spawn-wrap')
// wrap(wrapperArgs, environs)
var unwrap = wrap(['/path/to/my/main.js', 'foo=bar'], { FOO: 1 })
// later to undo the wrapping, you can call the returned function
unwrap()
In this example, the /path/to/my/main.js
file will be used as the
"main" module, whenever any Node or io.js child process is started,
whether via a call to spawn
or exec
, whether node is invoked
directly as the command or as the result of a shebang #!
lookup.
In /path/to/my/main.js
, you can do whatever instrumentation or
environment manipulation you like. When you're done, and ready to run
the "real" main.js file (ie, the one that was spawned in the first
place), you can do this:
// /path/to/my/main.js
// process.argv[1] === 'foo=bar'
// and process.env.FOO === '1'
// my wrapping manipulations
setupInstrumentationOrCoverageOrWhatever()
process.on('exit', function (code) {
storeCoverageInfoSynchronously()
})
// now run the instrumented and covered or whatever codes
require('spawn-wrap').runMain()
The initial wrap call uses synchronous I/O. Probably you should not be using this script in any production environments anyway.
Also, this will slow down child process execution by a lot, since we're adding a few layers of indirection.
Currently only works on systems that support shebangs and have bash, ie, all unixes and no windows.
FAQs
Wrap all spawned Node.js child processes by adding environs and arguments ahead of the main JavaScript file argument.
The npm package spawn-wrap receives a total of 3,734,315 weekly downloads. As such, spawn-wrap popularity was classified as popular.
We found that spawn-wrap demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 3 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
The Socket Research Team has discovered six new malicious npm packages linked to North Korea’s Lazarus Group, designed to steal credentials and deploy backdoors.
Security News
Socket CEO Feross Aboukhadijeh discusses the open web, open source security, and how Socket tackles software supply chain attacks on The Pair Program podcast.
Security News
Opengrep continues building momentum with the alpha release of its Playground tool, demonstrating the project's rapid evolution just two months after its initial launch.