Research
Security News
Malicious npm Package Targets Solana Developers and Hijacks Funds
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
Break out of localhost. Connect to any device from anywhere over any tcp port or securely in a browser. A secure tunnel. A poor man's reverse VPN.
Because friends don't let friends localhost™
| Sponsored by ppl | Telebit Remote | Telebit Relay | sclient |
If you need to get bits from here to there, Telebit gets the job done.
Install Telebit Remote on any device - your laptop, raspberry pi, whatever - and now you can access that device from anywhere, even securely in a web browser.
How does it work? It's a net server that uses a relay to allow multiplexed incoming connections on any external port.
You do this:
curl -fsSL https://get.telebit.io | bash
You get this:
~/telebit http 3000
> Forwarding lucky-duck-42.telebit.cloud => localhost:3000
~/telebit http ~/sites/example.com/
> Serving ~/sites/example.com/ as lucky-duck-42.telebit.cloud
And this:
~/telebit tcp 5050
> Forwarding telebit.cloud:1337 => localhost:5050
And even this:
~/telebit ssh auto
> Forwarding ssh telebit.cloud -p 1337 => localhost:22
> Forwarding ssh+https (openssl proxy) => localhost:22
No privileged ports. No sudo. End-to-end encryption.
Fastest way to test a site, share a file, and pair over ssh.
Open Terminal and run this install script:
curl -fsSL https://get.telebit.io | bash
What does the installer do?
~/Applications/telebit/
~/telebit
for convenience/etc/systemd/system/telebit.service
~/Library/LaunchAgents/cloud.telebit.remote.plist
~/.config/telebit/telebit.yml
~/.local/share/telebit
Of course, feel free to inspect it before you run it: curl -fsSL https://get.telebit.io
You can customize the installation:
export NODEJS_VER=v10.2 # v10.2 is tested working, but we can test other versions
export TELEBIT_VERSION=master # git tag or branch to install from
export TELEBIT_USERSPACE=no # install as a system service (launchd, systemd only)
export TELEBIT_PATH=/opt/telebit
export TELEBIT_USER=telebit
export TELEBIT_GROUP=telebit
curl -fsSL https://get.telebit.io/ | bash
That will change the bundled version of node.js is bundled with Telebit Relay and the path to which Telebit Relay installs.
npm install -g telebit
.config/telebit/telebitd.yml
(such as /Users/John/.config/telebit/telebitd.yml
).config/telebit/telebit.yml
(such as /Users/John/.config/telebit/telebit.yml
)npx telebit init
and follow the instructionsnpx telebit list
Note: Use node.js v10.2.1
(there are specific bugs in each of v8.x, v9.x, v10.0, and v10.3 that each cause telebit to crash)
# commands
telebit <command>
# domain and port control
telebit <service> <handler> [servername] [options ...]
Examples:
telebit status # whether enabled or disabled
telebit enable # disallow incoming connections
telebit disable # allow incoming connections
telebit restart # kill daemon and allow system launcher to restart it
telebit list # list rules for servernames and ports
################
# HTTP #
################
telebit http <handler> [servername] [opts]
telebit http none # remove all https handlers
telebit http 3000 # forward all https traffic to port 3000
telebit http /module/path # load a node module to handle all https traffic
telebit http none example.com # remove https handler from example.com
telebit http 3001 example.com # forward https traffic for example.com to port 3001
telebit http /module/path example.com # forward https traffic for example.com to port 3001
################
# TCP #
################
telebit tcp <handler> [servername] [opts]
telebit tcp none # remove all tcp handlers
telebit tcp 5050 # forward all tcp to port 5050
telebit tcp /module/path # handle all tcp with a node module
telebit tcp none 6565 # remove tcp handler from external port 6565
telebit tcp 5050 6565 # forward external port 6565 to local 5050
telebit tcp /module/path 6565 # handle external port 6565 with a node module
telebit ssh disable # disable ssh access
telebit ssh 22 # port-forward all ssh connections to port 22
telebit save # save http and tcp configuration changes
SSH over HTTPS
ssh -o ProxyCommand='openssl s_client -connect %h:443 -servername %h -quiet' lucky-duck-42.telebit.cloud
SSH over non-standard port
ssh lucky-duck-42.telebit.cloud -p 3031
~/Applications/bin/node ~/Applications/bin/telebitd.js --config ~/.config/telebit/telebitd.yml
Options
~/.config/telebit/telebitd.yml:
email: 'jon@example.com' # must be valid (for certificate recovery and security alerts)
agree_tos: true # agree to the Telebit, Greenlock, and Let's Encrypt TOSes
relay: wss://telebit.cloud # a Telebit Relay instance
community_member: true # receive infrequent relevant but non-critical updates
telemetry: true # contribute to project telemetric data
secret: '' # Secret with which to sign Tokens for authorization
#token: '' # A signed Token for authorization
ssh_auto: 22 # forward ssh-looking packets, from any connection, to port 22
servernames: # servernames that will be forwarded here
example.com: {}
You can create a free or paid account at https://telebit.cloud or you can run Telebit Relay open source on a VPS (Vultr, Digital Ocean) or your Raspberry Pi at home (with port-forwarding).
Only connect to Telebit Relays that you trust.
Linux:
SYSTEMD_LOG_LEVEL=debug journalctl -xef --user-unit=telebit
macOS:
tail -f ~/local/share/telebit/var/log/info.log
tail -f ~/.local/share/telebit/var/log/error.log
Linux:
systemctl --user disable telebit; systemctl --user stop telebit
rm -f ~/.config/systemd/user/telebit.service
rm -rf ~/telebit ~/Applications/telebit
rm -rf ~/.config/telebit ~/.local/share/telebit
macOS:
launchctl unload -w ~/Library/LaunchAgents/cloud.telebit.remote.plist
rm -f ~/Library/LaunchAgents/cloud.telebit.remote.plist
rm -rf ~/telebit ~/Applications/telebit
rm -rf ~/.config/telebit ~/.local/share/telebit
This is implemented with websockets, so you should be able to
Copyright 2016-2018+ AJ ONeal
FAQs
Break out of localhost. Connect to any device from anywhere over any tcp port or securely in a browser. A secure tunnel. A poor man's reverse VPN.
The npm package telebit receives a total of 149 weekly downloads. As such, telebit popularity was classified as not popular.
We found that telebit demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
Security News
Research
Socket researchers have discovered malicious npm packages targeting crypto developers, stealing credentials and wallet data using spyware delivered through typosquats of popular cryptographic libraries.
Security News
Socket's package search now displays weekly downloads for npm packages, helping developers quickly assess popularity and make more informed decisions.