Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
terminal-spawn
Advanced tools
A library which wraps Node's child_process.spawn to provide easy use of terminal commands.
A library which wraps Node's child_process.spawn
to provide easy use of terminal commands.
It does this in an easy to use way by providing a nice interface on top of
child_process.spawn
which allows you to call it exactly the same way as
if you were running commands directly in the terminal.
I personally use this for running gulp tasks,
since I got used to using npm scripts and their ability to directly run terminal
commands very easily. Since it returns both a Promise
and a
ChildProcess
it can easily be used with gulp.
The promise resolves with the same information as spawnSync
and does so once the close
event has been received and thus you
can await the promise to resolve if you wish to ensure it completed.
This project uses TypeScript and thus has types for it exported, so it works well in that environment. However, it also works just fine with vanilla JavaScript.
npm install terminal-spawn
import terminalSpawn from 'terminal-spawn';
terminalSpawn('echo "hello world!"');
import terminalSpawn from 'terminal-spawn';
// execute inside of IIAFE since we can't use top-level await
(async () => {
const subprocess = await terminalSpawn('echo "hello world!"').promise;
if (subprocess.status === 0) {
console.log('everything went well!');
} else {
console.warn('something went wrong!!!!');
}
})();
import terminalSpawn from 'terminal-spawn';
// execute inside of IIAFE since we can't use top-level await
(async () => {
const subprocessSpawn = terminalSpawn(`
while true
do
echo "hello world!"
sleep 0.25
done
`);
// wait for 500 ms to pass...
const timeToWait = 500;
await new Promise((resolve, _reject) =>
setTimeout(() => {
resolve();
}, timeToWait),
);
subprocessSpawn.process.kill();
// subprocess.signal should be 'SIGTERM'
const subprocess = await subprocessSpawn.promise;
})();
return type:
{
promise: Promise<SpawnSyncReturns<Buffer>>
process: ChildProcess
}
Executes the command inside of Node.js as if it were run in the shell. If command is an array then the commands will be run in series/sequentially.
The result is an object which contains both a Promise
which has
the same structure/type as the return value of the synchronous version of child_process.spawn
.
and also a 'ChildProcess`. Each of these are useful in certain
circumstances, for example you need the process reference if you want to kill
an infinite process. You may want to use the promise to check status codes
or termination signals to verify that the process actually ended and how.
return type:
{
promise: Promise<SpawnSyncReturns<Buffer>>
process: ChildProcess
}
Executes the command inside of Node.js as if it were run in the shell, if command is an array then the commands will be run in parallel rather than in series/sequentially.
The result is an object which contains both a Promise
which has
the same structure/type as the return value of the synchronous version of child_process.spawn
.
and also a 'ChildProcess`. Each of these are useful in certain
circumstances, for example you need the process reference if you want to kill
an infinite process. You may want to use the promise to check status codes
or termination signals to verify that the process actually ended and how.
type: string
or string[]
The command will be run using the shell and the output will be redirected to the
shell. This means that it will essentially function as if you ran it directly in
a shell such as /bin/sh
, but inside of Node.js.
If command is an array then all of the commands in the array will be executed:
either in series or in parallel, depending on the function. The default is to
executed them in series, as if they were called with &&
between them.
type: SpawnOptions
These are the options to pass to child_process.spawn
they are the same as the spawn
options
and are passed directly to child_process.spawn
.
By default they are:
{
stdio: 'inherit',
shell: true,
}
Which allows terminalSpawn
to act like a terminal. However, if you wanted the
nice argument passing of terminalSpawn, e.g. 'echo "hello world!"
without
actually using the terminal, then you could disable this using options
.
The API for options is designed to be as user-friendly as possible thus,
it assumes that you want to keep the terminal-like behavior, but may want
to change other options such as using cwd
. To support this the user-provided
options are added to the default options, rather than always overwriting them
(aka. set union). However, if you explicitly specify a a default command such
as stdio
then it will be overwritten.
However, it should be noted that if you pass the option shell: false
then
many features such as multiple commands run in series or parallel will not work
due to reliance on running in a shell.
MIT Copyright (c) David Piper
FAQs
A library which wraps Node's child_process.spawn to provide easy use of terminal commands.
The npm package terminal-spawn receives a total of 0 weekly downloads. As such, terminal-spawn popularity was classified as not popular.
We found that terminal-spawn demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.