
Security Fundamentals
Turtles, Clams, and Cyber Threat Actors: Shell Usage
The Socket Threat Research Team uncovers how threat actors weaponize shell techniques across npm, PyPI, and Go ecosystems to maintain persistence and exfiltrate data.
Listen, monitor and archive your streams!
If you need to listen or archive an Icecast stream, you will need ffmpeg
:
sudo apt install ffmpeg
Install earhorn from pip (install the s3 extra to upload the segment to an s3 bucket):
pipx install earhorn
pipx install earhorn[s3]
You can start archiving an Icecast stream by providing a stream url and an archive path:
earhorn \
--stream-url https://stream.example.org/live.ogg \
--archive-path=/to/my/archive
You can also start exporting the Icecast stats as prometheus metrics by providing an Icecast stats url:
earhorn \
--stats-url https://stream.example.org/admin/stats.xml \
--stats-user admin \
--stats-password hackme
docker pull ghcr.io/jooola/earhorn
Usage: earhorn [OPTIONS]
ENVIRONMENT VARIABLES:
If a `.env` file is present in the current directory, it will be loaded and can be used to pass environment
variables to this tool.
ARCHIVE STORAGE:
The storage can be defined using a path to a local directory or an url to an s3 bucket. Segments will be saved on
the storage you specified.
To use an s3 bucket, you need to install the `s3` extras (`pip install earhorn[s3]`), use `s3://bucket-name` as
value for the `--archive-path` option and export the s3 bucket credentials listed in the table below:
| Variable | Description | Example |
| ----------------------- | ----------------------------------------- | --------------------------- |
| AWS_ACCESS_KEY_ID | The access key for your bucket user | AKIA568knmklmk |
| AWS_SECRET_ACCESS_KEY | The secret key for your bucket user | mi0y84wu498zxsasa |
| AWS_S3_ENDPOINT_URL | The endpoint to your s3 bucket (optional) | https://s3.nl-ams.scw.cloud |
| AWS_S3_REGION_NAME | Region of your s3 bucket | us-east-2 |
Example: export AWS_S3_ENPOINT_URL="https://s3.nl-ams.scw.cloud"
ARCHIVE SEGMENTS:
To change the segments duration or format, see the ffmpeg documentation for details
about the available options:
https://ffmpeg.org/ffmpeg-formats.html#segment_002c-stream_005fsegment_002c-ssegment
Options:
--listen-port INTEGER Listen port for the prometheus metrics endpoint. [default: 9950]
--hook PATH Path to a custom script executed to handle stream state `events`.
--stats-url TEXT URL to the icecast admin xml stats page.
--stats-user TEXT Username for the icecast admin xml stats page. [default: admin]
--stats-password TEXT Password for the icecast admin xml stats page.
--stream-url TEXT URL to the icecast stream.
--silence-detect-noise TEXT Silence detect noise. [default: -60dB]
--silence-detect-duration TEXT Silence detect duration. [default: 2]
--archive-path PATH Path or url to the archive storage, supported storage are local filesystem and s3.
If defined, the stream will be archived in the storage as segments.
--archive-segment-filepath TEXT
Archive segment filepath. [default:
{year}/{month}/{day}/{hour}{minute}{second}.{format}]
--archive-segment-size INTEGER Archive segment size in seconds. [default: 3600]
--archive-segment-format TEXT Archive segment format. [default: ogg]
--archive-segment-format-options TEXT
Archive segment format options.
--archive-copy-stream Copy the `stream` without transcoding (reduce CPU usage). WARNING: The stream has to
be in the same format as the `--archive-segment-format`.
--help Show this message and exit.
To develop this project, start by reading the Makefile
to have a basic understanding of the possible tasks.
Install the project and the dependencies in a virtual environment:
make install
source .venv/bin/activate
earhorn --help
FAQs
Listen, monitor and archive your streams!
We found that earhorn demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security Fundamentals
The Socket Threat Research Team uncovers how threat actors weaponize shell techniques across npm, PyPI, and Go ecosystems to maintain persistence and exfiltrate data.
Security News
At VulnCon 2025, NIST scrapped its NVD consortium plans, admitted it can't keep up with CVEs, and outlined automation efforts amid a mounting backlog.
Product
We redesigned our GitHub PR comments to deliver clear, actionable security insights without adding noise to your workflow.