Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
ssh2-connect
Advanced tools
The Node.js ssh2-connect package extends the ssh2
module to provide a simplified callback-back approach to initiate a new SSH connection.
The connect
function return a promise. Its signature is await connect(options)
It also accept an optional callback function. In such case, its signature is connect(options, callback)
.
This package simplifies the creation of an SSH connection. For example, the original ssh2 code...
const ssh2 = require('ssh2')
const connection = new ssh2()
connection.on('error', function(err){
// Handle the connection error
connection.end()
})
connection.on('ready', function(){
// Work with the connection
connection.end()
})
connection.connect({
host: 'localhost',
user: 'milou',
password: 'wafwaf'
})
...is simplified to:
const connect = require('ssh2-connect')
(async () => {
try{
const ssh = await connect({
host: 'localhost',
username: 'david',
private_key_path: '~/.ssh/id_rsa'
})
// Work with the connection
ssh.end()
}catch (err){
// Handle the connection error
}
})()
Options are inherited from the ssh2 Connection.prototype.connect
function with a few additions:
username
privateKeyPath
true
to enable auto-discovery or false
to disable auto-discovery, default to true
.retry
Attempt to reconnect multiple times, default to 1
.wait
Time to wait in milliseconds between each retry, default to 2000
.Note, the "privateKeyPath" option is provided as a conveniency to read the private key and fill the "privateKey" property.
Additionally, all options may be provided in camalize (the default in ssh2) or underscore form. For example, both "privateKey" and "private_key" would be interprated the same.
This is OSS and licensed under the new BSD license.
npm install ssh2-connect
The example is using both the "ssh2-connect" and "ssh2-fs" modules.
const connect = require('ssh2-connect');
const fs = require('ssh2-fs');
// Open the connection
connect({host: 'localhost'}, function(err, ssh){
// Create a directory
fs.mkdir(ssh, '/tmp/a_dir', (err, stdout, stderr){
console.log(stdout);
});
});
Compare this to the more verbose alternative using the original ssh2 module.
ssh2 = require('ssh2');
fs = require('ssh2-fs');
connection = new ssh2();
connection.on('error', function(err){
connection.end()
});
connection.on('ready', function(){
fs.mkdir(connection, '/tmp/a_dir', (err, stdout, stderr){
console.log(stdout);
});
});
connection.connect({host: 'localhost'});
Tests are executed with mocha. To install it, simple run npm install
, it will install mocha and its dependencies in your project "node_modules" directory.
To run the tests:
npm test
To generate the JavaScript files:
npm run build
The test suite is run online with GitHub action against several Node.js version.
Versions are incremented using semantic versioning. To create a new version and publish it to NPM, run:
npm run release
# Or
npm run release:<major|minor|patch>
The NPM publication is handled with the GitHub action.
This package is developed by Adaltas.
FAQs
Callback-based api behind ssh2 to open an SSH connection
The npm package ssh2-connect receives a total of 962 weekly downloads. As such, ssh2-connect popularity was classified as not popular.
We found that ssh2-connect demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.