Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Dedicated container/script to upload files to openzim/kiwix warehouses and S3
Files are uploaded via SFTP (pubkey authentication) or SCP using OpenSSH.
--file
./etc/ssh/keys/id_rsa
or use --private_key
scp://
or sftp://
URI to specify target./
for uploading inside a folderdocker run \
-v ~/.ssh/id_rsa:/etc/ssh/keys/id_rsa:ro \
-v /path/:/path:rw \
openzim/uploader \
uploader \
--file /path/my_file.zim \
--upload-uri sftp://uploader@warehouse.farm.openzim.org/zim/ \
--move \
--delete
--username
: if your URI has no username, you can specify it here.--move
: upload to a temporary filename (<fname>.tmp
) and rename it upon completion. Note that SCP is not able to do it so it uploads an <fname>.complete
file upon completion instead.--delete
: delete source file once uploaded successfuly.--compress
: enable transfer compression.--bandwidth
: enable bandwidth limit. Set it in Kbps.--cipher
: change default cipher (aes128-ctr
).--resume
: resume partially uploaded file (SFTP only)pip3 install openzim_uploader[all]
openzim-uploader --help
from openzim_uploader import check_and_upload_file
check_and_upload_file(
src_path="/path/my_file.zim",
upload_uri="sftp://uploader@warehouse.farm.openzim.org/zim/",
private_key="~/.ssh/id_rsa",
)
Note: check_and_upload_file
returns an unix-like returncode (0
on success)
FAQs
SCP/SFTP helper for openZIM uploads to our dropbox
We found that openzim-uploader demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.