Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Provides a HTTP Server which can be used to intercept and modify API requests/responses for local clients.
This is useful for client testing where generating different response types from the API is not always ideal.
The HTTP server provides the following functionality:
When a request comes in methods are checked & executed in the following order:
Sites can be hosted as with any webserver. The server supports static sites/resources only.
An example configuration file:
{
"/": {
"doc_root": "default_sites/",
"active": true,
"description": "Root Site"
},
"/example": {
"doc_root": "default_sites/example/",
"active": true,
"description": "Example Site"
}
}
A configured site configurations key will be set to the expected url path.
Site configuration parameters:
doc_root
: String - The full path to the configured site. A relative path can also be configured and is explained below.active
: Boolean - True if the site is to be served.description
: String - [optional] A description for your site.TODO
These are your standard redirects.
These are useful for clients that do not support redirects.
An example use would be redirecting a client with hard coded endpoints to a lab environemnt for testing without having to generate & install specific builds for the lab.
Parameters:
host
: String - [optional] The full domain to redirect to.paths
: Object - [optional] An object containing the paths being redirected for this domain.active
: Boolean - True to enable redirect.description
: String - [optional] A description for your redirect.Note: at least one of host
or paths
must be specified!
Path object:
host
: String - [optional] The full domain to redirect to.path
: String - [optional] The full path to redirect to. If omitted then the path will be set to domain root.status
: Number - [optional] The HTTP 3xx status to send. Specifying this parameter tells the server to use a HTTP 3xx redirect rather than redirecting transparently.active
: Boolean - True to enable redirect.description
: String - [optional] A description for your redirect.Note: at least one of path
or host
(from either site/path config) must be specified!
If a host is specifed in the key it will only by honoured when intercepting or proxying, for anything else the keys will be ignored.
Redirecting paths within the same site:
{
"example.com": {
"paths": {
"/example_redirect": {
"path": "/temp_path",
"active": true,
}
},
"active": true,
}
}
Redirecting paths within the same site using a HTTP 3xx redirect:
{
"example.com": {
"paths": {
"/example_redirect": {
"path": "/temp_path",
"status": 301,
"active": true,
}
},
"active": true,
}
}
Redirecting paths from one site to another:
{
"example.com": {
"host": "example2.com",
"paths": {
"/example_redirect": {
"path": "/",
"active": true,
}
},
"active": true,
}
}
This can also be done on a path by path basis:
{
"example.com": {
"paths": {
"host": "example2.com",
"/example_redirect": {
"path": "/",
"active": true,
},
"/example_redirect2": {
"host": "example3.com",
"path": "/",
"active": true,
}
},
"active": true,
}
}
If a host is configured for a path it takes precedence over the site redirect host.
Redirecting one domain to another:
{
"example.com": {
"host": "example2.com",
"active": true,
}
}
This applies to all paths for the domain.
Parameters:
active
: Boolean - True to enable proxy.description
: String - [optional] A description for your proxy.An example configuration file:
{
"example.com": {
"active": true,
"description": "Intercept & modify"
}
}
Parameters:
active
: Boolean - True to enable proxy.description
: String - [optional] A description for your proxy.Proxy can be configured to either proxy all requests:
{
"*": {
"active": true,
"description": "Proxy All"
}
}
or specific domains only:
{
"example.com": {
"active": true,
"description": "Proxy example.com"
}
}
The '*' character can be used as a wildcard.
*.example.com
will handle requests for all subdomains, but not example.com
.
*example.com
will handle requests for all subdomains, including example.com
.
In the following example the first configuration example.com
will only proxy requests for example.com
.
While the second configuration \*.example.com
will proxy all subdomains but not example.com
.
{
"example.com": {
"active": true,
"description": "Proxy example.com"
},
"*.example.com": {
"active": true,
"description": "Proxy subdomains of example.com"
}
}
This snippet can be simplified to:
{
"*example.com": {
"active": true,
"description": "Proxy example.com and all subdomains"
}
}
/testing/*
will redirect all requests for path /testing
including sub paths i.e /testing/path_a
In the following example example.com/example_redirect
and all sub paths will be redirected to example.com/temp_path
.
{
"example.com": {
"paths": {
"/example_redirect/*": {
"path": "/temp_path",
"active": true,
}
},
"active": true,
}
}
FAQs
Unknown package
We found that pyhttpintercept demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.