
Research
NPM targeted by malware campaign mimicking familiar library names
Socket uncovered npm malware campaign mimicking popular Node.js libraries and packages from other ecosystems; packages steal data and execute remote code.
Create a tunnel:
import tunnel from 'tunnel-rat'
const t = tunnel()
Use the tunnel's In
component to send one or more elements into the tunnel:
<t.In>
<h1>Very cool!</h1>
<p>These will appear somewhere else!</p>
</t.In>
Somewhere else, use the tunnel's Out
component to render them:
<t.Out />
This example describes a simple React app that has both a HTML UI as well as a @react-three/fiber 3D scene. Each of these is rendered using separate React renderers, which traditionally makes emitting HTML from within the Canvas a bit of a pain; but thanks to tunnel-rat, this is now super easy!
import { Canvas } from '@react-three/fiber'
import tunnel from 'tunnel-rat'
/* Create a tunnel. */
const ui = tunnel()
const App = () => (
<div>
<div id="ui">
{/* Anything that goes into the tunnel, we want to render here. */}
<ui.Out />
</div>
{/* Here we're entering the part of the app that is driven by
@react-three/fiber, where all children of the <Canvas> component
are rendered by an entirely separate React renderer, which would
typically not allow the use of HTML tags. */}
<Canvas>
{/* Let's send something into the tunnel! */}
<ui.In>
<p>Hi, I'm a cube!</p>
</ui.In>
<mesh>
<boxGeometry />
<meshBasicMaterial />
</mesh>
{/* You can send multiple things through the tunnel, and
they will all show up in the order that you've defined them in! */}
<ui.In>
<p>And I'm a sphere!</p>
</ui.In>
<mesh>
<sphereGeometry />
<meshBasicMaterial />
</mesh>
</Canvas>
</div>
)
Of course, the whole thing also works the other way around:
import { Canvas } from '@react-three/fiber'
import tunnel from 'tunnel-rat'
/* Create a tunnel. */
const three = tunnel()
const App = () => (
<div>
<div id="ui">
{/* Let's beam something into the R3F Canvas! */}
<three.In>
<mesh>
<sphereGeometry />
<meshBasicMaterial />
</mesh>
</three.In>
</div>
<Canvas>
{/* Render anything sent through the tunnel! */}
<three.Out />
</Canvas>
</div>
)
0.1.2
FAQs
non gratum anus rodentum
The npm package tunnel-rat receives a total of 285,625 weekly downloads. As such, tunnel-rat popularity was classified as popular.
We found that tunnel-rat demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Socket uncovered npm malware campaign mimicking popular Node.js libraries and packages from other ecosystems; packages steal data and execute remote code.
Research
Socket's research uncovers three dangerous Go modules that contain obfuscated disk-wiping malware, threatening complete data loss.
Research
Socket uncovers malicious packages on PyPI using Gmail's SMTP protocol for command and control (C2) to exfiltrate data and execute commands.