Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Wrapper for the Windows `tasklist` command. Returns a list of apps and services with their Process ID (PID) for all tasks running on either a local or a remote computer.
Wrapper for the Windows
tasklist
command. Returns a list of apps and services with their Process ID (PID) for all tasks running on either a local or a remote computer.
Cleans up and normalizes the data.
$ npm install tasklist
import {tasklist} from 'tasklist';
console.log(await tasklist());
/*
[
{
imageName: 'taskhostex.exe',
pid: 1820,
sessionName: 'Console',
sessionNumber: 1,
memUsage: 4415488
},
…
]
*/
See the tasklist
docs for more.
Returns a Promise<object[]>
that contains the normalized results of the command output.
Examples for options
below will use this interface, but you can check tasklist.stream
below for usage of the stream interface.
Returns a stream.Readable
that returns the resulting lines, normalized, one-by-one.
Options are the same as the Promise interface.
import {tasklistStream} from 'tasklist';
tasklistStream({verbose: true}).pipe(process.stdout);
/*
{
imageName: 'taskhostex.exe',
pid: 1820,
sessionName: 'Console',
sessionNumber: 1,
memUsage: 4415488,
status: 'Running',
username: 'SINDRESORHU3930\\sindre'
cpuTime: 0,
windowTitle: 'Task Host Window'
}
…
*/
Type: object
Warning
system
, username
, password
options must be specified together.modules
and services
options can't be specified if verbose is set to true
.modules
and services
options can't be specified at the same time.system
, username
, password
options are specified, the filter option can't have windowtitle
and status
as the parameter.Type: boolean
Default: false
Return verbose results.
Without the verbose
and apps
option, tasklist
returns tasks with the following properties:
imageName
(Type: string
)pid
(Type: number
)sessionName
(Type: string
)sessionNumber
(Type: number
)memUsage
in bytes (Type: number
)With the verbose
option set to true
but the apps
option still set to false
, it additionally returns the following properties:
status
(Type: string
): One of Running
, Suspended
, Not Responding
, or Unknown
username
(Type: string
)cpuTime
in seconds (Type: number
)windowTitle
(Type: string
)Note: It's not guaranteed that the username
and windowTitle
properties are returned with proper values. If they are not available, 'N/A'
may be returned on English systems. In contrast, 'Nicht zutreffend'
may be returned on German systems, for example.
Verbose example:
import {tasklist} from 'tasklist';
console.log(await tasklist({verbose: true}));
/*
[
{
imageName: 'taskhostex.exe',
pid: 1820,
sessionName: 'Console',
sessionNumber: 1,
memUsage: 4415488,
status: 'Running',
username: 'SINDRESORHU3930\\sindre'
cpuTime: 0,
windowTitle: 'Task Host Window'
},
…
]
*/
Warning: Using the verbose
option may have a considerable performance impact (See: #6).
Type: string
Name or IP address of a remote computer (don't use backslashes). The default is the local computer.
Type: string
Example: 'SINDRESORHU3930\\sindre'
User specified by User
or Domain\User
. The default is the permissions of the current logged on user on the computer issuing the command.
Type: string
Password of the user account for the specified username
.
Type: string[]
Specify the types of processes to include or exclude. More info.
Type: boolean
Displays store apps.
Without the verbose
option, the command returns the following data:
imageName
(Type: string
)pid
(Type: number
)memUsage
in bytes (Type: number
)packageName
(Type: string
)import {tasklist} from 'tasklist';
console.log(await tasklist({apps: true}));
/*
[
{
imageName: 'SearchUI.exe (CortanaUI)',
pid: 1820,
memUsage: 4415488,
packageName: 'Microsoft.Windows.Cortana'
},
…
]
*/
With the verbose
option set to true
, the command additionally returns the following data:
sessionName
(Type: string
)sessionNumber
(Type: number
)status
(Type: string
): One of Running
, Suspended
, Not Responding
, or Unknown
username
(Type: string
)cpuTime
in seconds (Type: number
)windowTitle
(Type: string
)Note: It's not guaranteed that the username
and windowTitle
properties are returned with proper values. If they are not available, 'N/A'
may be returned on English systems. In contrast, 'Nicht zutreffend'
may be returned on German systems, for example.
Verbose example:
import {tasklist} from 'tasklist';
console.log(await tasklist({apps: true, verbose: true}));
/*
[
{
imageName: 'SearchUI.exe (CortanaUI)',
pid: 1820,
sessionName: 'Console',
sessionNumber: 1,
memUsage: 4415488,
status: 'Running',
username: 'SINDRESORHU3930\\sindre'
cpuTime: 0,
windowTitle: 'N/A',
packageName: 'Microsoft.Windows.Cortana'
},
…
]
*/
Type: string
List all tasks using the given DLL module name. If an empty string is given, it will list all tasks with the used DLL modules.
Note: You can't use the verbose
option with this option set.
import {tasklist} from 'tasklist';
console.log(await tasklist({modules: 'wmiutils.dll'}));
/*
[{
imageName: 'chrome.exe',
pid: 1820,
modules: ['wmiutils.dll']
}, …]
*/
Type: boolean
Displays services hosted in each process.
Note: You can't use the verbose
option with this option set.
import {tasklist} from 'tasklist';
console.log(await tasklist({services: true}));
/*
[{
imageName: 'lsass.exe',
pid: 856,
services: ['KeyIso', 'SamSs', 'VaultSvc']
}, …]
*/
taskkill
commandFAQs
Wrapper for the Windows `tasklist` command. Returns a list of apps and services with their Process ID (PID) for all tasks running on either a local or a remote computer.
We found that tasklist demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.