Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
The RemotePDB package is a useful way to remotely debug code (i.e., code running in Docker). Normally, a user can simply wait for the set_trace()
command to be executed, then telnet to the appropriate port. However, in applications such as Django, this necessitates manually disconnecting the telnet session before another breakpoint can be processed.
With RemotePDB Client, the user can instantiate the client at any time, and it will pend until a debug connection becomes available. Likewise, after a PDB c(ontinue)
command the client will disconnect internally and await the next available connection.
You can use h(elp)
within the debugger to see the usual remote commands. q(uit)
/e(xit)
will forward the given command and then exit the Client completely.
A persistent history is available and is saved for re-use between client sessions.
The cl(ear)
breakpoints command is disallowed if it has no arguments (clearing all breakpoints causes the remote process to pend on y/n input).
If you are debugging code in a Docker container, remember to expose the internal port externally via your docker-compose
command or file (keeping in mind that the internal and external port numbers should be different).
There is a limit to what you can debug with this - if you call set_trace()
within code running in multiple threads/processes at the same time, only one will be connected to and the rest will pend or fail.
To avoid problems with BdbQuit
being raised by RemotePDB 2.0+ on remote disconnect, before exiting via Ctrl-C, e
xit, or q
uit we purposely send a "c
ontinue" command.
DO NOT use RemotePDB Client to connect to untrusted hosts!
FAQs
A client for the RemotePDB debugger
We found that remote-pdb-client demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.