Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
#USocket
The native node.js socket supports creating unix domain sockets, but they do not support passing file descriptors. This module includes replacements for net.Server and net.Socket that extend the API to allow passing file descriptors.
npm install usocket
var fs = require('fs');
var usocket = require('usocket');
var server = new usocket.UServer();
var client = new usocket.USocket();
server.listen(__dirname + "/socket", function() {
client.connect(__dirname + "/socket");
});
server.on('connection', function(connection) {
var msg = Buffer.from("message");
var fd = fs.openSync(__filename, "r");
setTimeout(function() {
connection.end({ data: msg, fds: [fd], callback: function() { fs.close(fd); } });
}, 500);
});
client.on('connected', function() { client.read(0); });
client.on('readable', function() {
var msg = client.read(7, 1);
if (!msg) return;
fs.close(msg.fds[0]);
server.close();
client.end();
})
The UServer class largely mimics the behavior of the native net.Server, but
the 'connection'
event will create usocket.USockets
.
Emitted on receipt of a new connection. The only argument is a new instance of usocket.USocket.
Emitted when there is an error on the socket.
Emitted when the socket is ready to accept connections.
Start a local socket server listening for connection on the supplied path.
The optional callback will be set as a listener of the 'listening'
event.
Start a local socket server listening for connection on the supplied path.
The optional callback will be installed as a listener of the 'listening'
event.
Causes the server to pause accepting new connections. No more 'connection'
events
will be emitted until resume
is called.
Resumes accepting connections on a paused server.
Closes the connection. No further events will be emitted. Unlike the native
net.Server there is no 'close'
event and the accepted connections are not
tracked.
The USocket class mirrors the net.Socket class but extends the API of several methods. A USocket implements the Duplex stream interface.
Constructs a new USocket object. If the options object is provided, the
connect
method will be called immeditately.
The event is emitted without arguments when the socket is connected.
This event indicates an error occurred on the socket. The 'close' event will follow.
This event is emitted when the socket is completely closed and no more events will be generated and no more data may be sent.
This event is emitted as a readable stream and when there are new file descriptors available for reading.
Connect to the unix domain server at the supplied path. The optional callback
will be set as a listener of the 'connected'
event.
Implements the readable stream API.
When an optional second argument is provided to the read method its operation
is modified. The length
argument indicates the amount of data to be read from
the stream. If length
is null then all the available data will be returned.
The count
argument indicates the number of file descriptors to be read from
the stream. If count
is null all available descriptors will be read. count
is allowed to be zero.
If either the data or descriptors isn't available, the call will return null. Otherwise the two argument read returns an object instead of a buffer.
The buffer
will put back on the the data read stream as per the readable
stream interface. The optional fds
is an array of file descriptors that
will be put back onto the stream for subsequent reads.
Implements the writable stream API.
Writing an array of integers will send file descriptors across the socket. The file descriptors must be kept open until the data is sent.
Passing an options object to write allows simultaneously writing data and file descriptors. It also provides a means to know when the data has been sent and it is safe to close the file descriptors.
Closes the socket. No further events will be emitted.
FAQs
unix local sockets with descriptor passing
We found that usocket demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.