
Research
SANDWORM_MODE: Shai-Hulud-Style npm Worm Hijacks CI Workflows and Poisons AI Toolchains
An emerging npm supply chain attack that infects repos, steals CI secrets, and targets developer AI toolchains for further compromise.
A command-line tool for running node.js servers.
cluster to automatically fork server processes into the backgrounddomain module to catch and report errors per-request$ ls .
package.json node_modules/ app.js
$ cat app.js
module.exports = http.createServer(function(req, resp) {
resp.end('woo')
})
$ utensil -p 8000
spawning 8 processes listening on 0.0.0.0:8000
Zing! utensil will also handle unhandled exceptions for you, serving up a
500 page where appropriate (without taking down your node process!)
The port to bind to.
The address to bind to.
The number of processes to fork. Defaults to the number of cpus
reported by require('os').cpus().length.
The millisecond interval that child process should report their memory usage.
Path to a JavaScript module that exports a single function taking pid and msg.
Messages are of the form:
{ "type": "metrics" | "error" | "console"
, "subtype": <subtype>
, "data": <message> }
data will include the output of process.memoryUsage().
{ "type": "metrics"
, "subtype": "request"
, "data": { "start": <unix ms epoch timestamp>
, "elapsed": <ms from request received till response>
, "status": <HTTP status code of response>
, "url": <contents of `req.url`> } }
For global, pre-runtime errors:
{ "type": "error"
, "subtype": "application"
, "data": { "err": <err+''>
, "stack": <err.stack if available> } }
For errors during the duration of a request:
{ "type": "error"
, "subtype": "request"
, "data": { "err": <err+''>
, "start": <unix ms epoch timestamp>
, "elapsed": <ms from request received till response>
, "stack": <err.stack if available> } }
All console output will be redirected to the adaptor, as well.
{ "type": "console"
, "subtype": "error" | "warn" | "log"
, "data": [arguments to console] }
// console.js
// simply output everything.
module.exports = function(pid, msg) {
console.log('#%s %s/%s', pid, msg.type, msg.subtype, msg.data)
}
// run it with
// utensil --adaptor path/to/console.js
MIT
FAQs
a utensil to fork and monitor servers across cpus
We found that utensil demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
An emerging npm supply chain attack that infects repos, steals CI secrets, and targets developer AI toolchains for further compromise.

Company News
Socket is proud to join the OpenJS Foundation as a Silver Member, deepening our commitment to the long-term health and security of the JavaScript ecosystem.

Security News
npm now links to Socket's security analysis on every package page. Here's what you'll find when you click through.