Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
The Node.js ssh2-fs package extends the ssh2
module to provide transparent usage of the Node.js fs
API either locally or over SSH.
This is OSS and licensed under the MIT license.
npm install ssh2-fs
The TypeScript documentation is available in the Markdown and HTLM format using typedoc.
The API borrows from the node:fs.promises
module with the additionnal first
argument. The function run locally when "null" or it run over SSH when an
ssh2
client connection. Otherwise the API is strictly the same with a few
exception due to the SSH2 API:
exists
function which execute the call with 2 arguments: an error and
the exists argument.createReadStream
and createWriteStream
return a promise with
a stream argument.Only the asynchronous functions are ported, we have no plan to support
synchronous functions. Morevover, they are not supported by [ssh2
].
Non (yet) implemented functions are "ftruncate", "truncate", "fchown", "lchown", "fchmod", "lchmod", "fstat", "realpath", "rmdir", "close", "open", "utimes", "fsync", "write", "read", "appendFile", "watchFile", "unwatchFile", "watch".
The example is using both the "ssh2-connect" and "ssh2-fs" modules.
import connect from "ssh2-connect";
import fs from "ssh2-fs";
const ssh = await connect({ host: "localhost" });
await fs.mkdir(ssh, "/tmp/a_dir");
Tests are executed with mocha. To install it, simple run npm install
, it will install
mocha and its dependencies in your project "node_modules" directory.
To run the tests:
npm test
The test suite is run online with [GitHub actions][https://github.com/adaltas/node-ssh2-fs/actions] against Node.js, 0.10 and 0.11.
The tests run against the CoffeeScript source files.
To generate the JavaScript files:
make build
Versions are incremented using semantic versioning. To create a new version and publish it to NPM, run:
npm run release
# Or (`git push` is only supported for the release script)
npm run release:<major|minor|patch>
git push --follow-tags origin master
The NPM publication is handled with the GitHub action.
The project is sponsored by Adaltas based in Paris, France. Adaltas offers support and consulting on distributed systems, big data and open source.
FAQs
Transparent use of the `fs` module locally or over SSH
We found that ssh2-fs demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.