
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
A node addon for making Userspace IO on Linux accessible by javascript.
Currently implements process_vm_readv and process_vm_writev from sys/uio.
https://man7.org/linux/man-pages/man2/process_vm_readv.2.html
due to the nature of this addon it is beyond my capabilities to automatically test it, but it does work, at least on my arm v8 system (IMX8MM) running kernel 5.15.32 and debian 11.
int64 and uint64 have not been tested yet, I have no use for them at this point, but if one experiences problems with them head over to the issues tab:
https://github.com/GOcontroll/uiojs/issues
"dependencies": {
"uiojs": "1.1.1"
},
include the dependency in your package.json and npm install
or download the source and install it manually from the source
import { dataTypes, asap_element, process_read, process_write } from "uiojs";
let address = 0x422540; //the memory address to read from
let dataType = dataTypes.uint16; //the value to read is an unsigned 16 bit integer
let arraySize = 1; //it is a single value and not an array
asap_dutycycle = new asap_element(address, dataType, arraySize);
pid = 2842; //automate looking up the pid of the process you would like to influence, this is just a simple example
let dutycycle = process_read(pid, asap_dutycycle);
// do some work
let new_dutycycle = 900
process_write(pid, asap_dutycycle, new_dutycycle);
//process_read(pid, asap_dutycycle) == 900 now
these functions are also methods of the asap_element class:
let dutycycle = asap_dutycycle.process_read(pid)
asap_dutycycle.process_write(pid, new_dutycycle)
The regular process_read and process_write might be deprecated or altered to serve a more generic purpose at some point.
FAQs
Exposes Linux Userspace IO functions to javascript
We found that uiojs demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.