
Research
Two Malicious Rust Crates Impersonate Popular Logger to Steal Wallet Keys
Socket uncovers malicious Rust crates impersonating fast_log to steal Solana and Ethereum wallet keys from source code.
Astro is a JavaScript api wrapper for wp-cli.
var wp = require('wp-astro')
wp('core download')
$ npm install wp-astro
Requires WP-cli to be installed correctly and coincidently access to mysql
The api can be called a number of different ways for example:
// Standalone command
wp('core download')
// Flags as array
wp('config create', ['--dbname=example', '--dbuser=root'])
// command with config
wp('config create', {
input: `define('WP_DEBUG', true);`,
flags: {
dbname: 'example',
dbuser: 'root',
'extra-php': true
}
})
// Config object
wp({
command: 'config create'
flags: {
dbname: 'example',
dbuser: 'root'
}
})
Command
Define the wp cli command to call. The initial wp
is not required here as this is done behind the scenes.
wp({
command: 'core download'
})
Custom working directory
Set the current working directory for the command by default this uses the current working directory process.cwd()
.
This example will download the WordPress core to a folder called example
the folder must exist.
wp('core download', {
cwd: path.join(__dirname, 'example')
})
Flags
Any flags needed for the command are added here. Flags can be passed as an array or object.
wp('post get 1', ['field=id', '--format=json'])
// OR
wp({
command: 'post get 1',
flags: {
field: 'id',
format: 'json'
}
})
// OR
wp({
command: 'post get 1',
flags: ['field=id', '--format=json']
})
Async
By default astro is synchronous by enabling async, commands can be run in parallel making for faster scripts.
Note: Running async on commands which require a previous command will not work as the previous command may not have completed!
Astro returns back the child process object meaning we have access to the events that triggers
var plugin = wp('plugin install hello', {
async: true,
flags: ['--activate']
})
plugin.on('data', function (data) {
console.log(data.toString())
})
plugin.on('close', function (code, signal) {
console.log(code)
})
For commands where data is piped into the command like wp config create this would be more appropriate:
var config = wp('config create', {
async: true,
flags: {
dbname: 'example',
dbuser: 'root',
dbpass: 'root',
'extra-php': true
}
})
config.stdin.write(`
define('WP_DEBUG', true);
`)
config.end()
Verbose
Enable verbose mode to log wp cli's output to the console useful for debugging.
wp('core download', {
verbose: true
})
Other Options
Behind the scenes we are just calling the wp-cli command with node's child_process module.
Depending on if async is enabled or disabled depends on which method we use, by default (async set to false) we use execSync otherwise if async is enabled we use exec
fortunatly that means we can pass any of it's config values in like so:
wp({
input: `define('WP_DEBUG', true);`, // Only avalible not async
cwd: path.resolve(__dirname, 'example'),
env: {},
encoding: 'utf8',
shell: '/bin/sh',
timeout: 0,
maxBuffer: 200*1024,
killSignal: 'SIGTERM',
uid: ,
gid: ,
callback: function (error, stdout, stderr) {} // Only on async
})
FAQs
JavaScript api wrapper for wp-cli
The npm package wp-astro receives a total of 1 weekly downloads. As such, wp-astro popularity was classified as not popular.
We found that wp-astro demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Socket uncovers malicious Rust crates impersonating fast_log to steal Solana and Ethereum wallet keys from source code.
Research
A malicious package uses a QR code as steganography in an innovative technique.
Research
/Security News
Socket identified 80 fake candidates targeting engineering roles, including suspected North Korean operators, exposing the new reality of hiring as a security function.