
Research
Two Malicious Rust Crates Impersonate Popular Logger to Steal Wallet Keys
Socket uncovers malicious Rust crates impersonating fast_log to steal Solana and Ethereum wallet keys from source code.
xshell-node-pty
Advanced tools
forkpty(3)
bindings for node.js. This allows you to fork processes with pseudoterminal file descriptors. It returns a terminal object which allows reads and writes.
This is useful for:
node-pty
supports Linux, macOS and Windows. Windows support is possible by utilizing the Windows conpty API on Windows 1809+ and the winpty library in older version.
The full API for node-pty is contained within the TypeScript declaration file, use the branch/tag picker in GitHub (w
) to navigate to the correct version of the API.
import * as os from 'node:os';
import * as pty from 'node-pty';
const shell = os.platform() === 'win32' ? 'powershell.exe' : 'bash';
const ptyProcess = pty.spawn(shell, [], {
name: 'xterm-color',
cols: 80,
rows: 30,
cwd: process.env.HOME,
env: process.env
});
ptyProcess.onData((data) => {
process.stdout.write(data);
});
ptyProcess.write('ls\r');
ptyProcess.resize(100, 40);
ptyProcess.write('ls\r');
node-pty
powers many different terminal emulators, including:
Do you use node-pty in your application as well? Please open a Pull Request to include it here. We would love to have it in our list.
# Install dependencies and build C++
npm install
# Compile TypeScript -> JavaScript
npm run build
Node.JS 16 or Electron 19 is required to use node-pty
. What version of node is supported is currently mostly bound to whatever version Visual Studio Code is using.
sudo apt install -y make python build-essential
Xcode is needed to compile the sources, this can be installed from the App Store.
npm install
requires some tools to be present in the system like Python and C++ compiler. Windows users can easily install them by running the following command in PowerShell as administrator. For more information see https://github.com/felixrieseberg/windows-build-tools:
npm install --global --production windows-build-tools
The following are also needed:
The wiki contains instructions for debugging node-pty.
All processes launched from node-pty will launch at the same permission level of the parent process. Take care particularly when using node-pty inside a server that's accessible on the internet. We recommend launching the pty inside a container to protect your host machine.
Note that node-pty is not thread safe so running it across multiple worker threads in node.js could cause issues.
Automatic flow control can be enabled by either providing handleFlowControl = true
in the constructor options or setting it later on:
const PAUSE = '\x13'; // XOFF
const RESUME = '\x11'; // XON
const ptyProcess = pty.spawn(shell, [], {handleFlowControl: true});
// flow control in action
ptyProcess.write(PAUSE); // pty will block and pause the child program
...
ptyProcess.write(RESUME); // pty will enter flow mode and resume the child program
// temporarily disable/re-enable flow control
ptyProcess.handleFlowControl = false;
...
ptyProcess.handleFlowControl = true;
By default PAUSE
and RESUME
are XON/XOFF control codes (as shown above). To avoid conflicts in environments that use these control codes for different purposes the messages can be customized as flowControlPause: string
and flowControlResume: string
in the constructor options. PAUSE
and RESUME
are not passed to the underlying pseudoterminal if flow control is enabled.
Internal Windows PowerShell error. Loading managed Windows PowerShell failed with error 8009001d.
This happens when PowerShell is launched with no SystemRoot
environment variable present.
This error can occur due to anti-virus software intercepting winpty from creating a pty. To workaround this you can exclude this file from your anti-virus scanning node-pty\build\Release\winpty-agent.exe
This project is forked from chjj/pty.js with the primary goals being to provide better support for later Node.js versions and Windows.
Copyright (c) 2012-2015, Christopher Jeffrey (MIT License).
Copyright (c) 2016, Daniel Imms (MIT License).
Copyright (c) 2018, Microsoft Corporation (MIT License).
FAQs
Fork pseudoterminals in Node.JS
We found that xshell-node-pty demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Socket uncovers malicious Rust crates impersonating fast_log to steal Solana and Ethereum wallet keys from source code.
Research
A malicious package uses a QR code as steganography in an innovative technique.
Research
/Security News
Socket identified 80 fake candidates targeting engineering roles, including suspected North Korean operators, exposing the new reality of hiring as a security function.