
Research
/Security News
Intercom’s npm Package Compromised in Ongoing Mini Shai-Hulud Worm Attack
Compromised intercom-client@7.0.4 npm package is tied to the ongoing Mini Shai-Hulud worm attack targeting developer and CI/CD secrets.
terminado
Advanced tools
This is a Tornado websocket backend for the Xterm.js Javascript terminal emulator library.
It evolved out of pyxterm, which was part of GraphTerm (as lineterm.py), v0.57.0 (2014-07-18), and ultimately derived from the public-domain Ajaxterm code, v0.11 (2008-11-13) (also on Github as part of QWeb).
Modules:
terminado.management: controls launching virtual terminals,
connecting them to Tornado's event loop, and closing them down.terminado.websocket: Provides a websocket handler for
communicating with a terminal.terminado.uimodule: Provides a Terminal Tornado UI
Module.JS:
terminado/_static/terminado.js: A lightweight wrapper to set up a
term.js terminal with a websocket.Local Installation:
$ pip install -e .[test]
Usage example:
import os.path
import tornado.web
import tornado.ioloop
# This demo requires tornado_xstatic and XStatic-term.js
import tornado_xstatic
import terminado
STATIC_DIR = os.path.join(os.path.dirname(terminado.__file__), "_static")
class TerminalPageHandler(tornado.web.RequestHandler):
def get(self):
return self.render(
"termpage.html",
static=self.static_url,
xstatic=self.application.settings["xstatic_url"],
ws_url_path="/websocket",
)
if __name__ == "__main__":
term_manager = terminado.SingleTermManager(shell_command=["bash"])
handlers = [
(r"/websocket", terminado.TermSocket, {"term_manager": term_manager}),
(r"/", TerminalPageHandler),
(
r"/xstatic/(.*)",
tornado_xstatic.XStaticFileHandler,
{"allowed_modules": ["termjs"]},
),
]
app = tornado.web.Application(
handlers,
static_path=STATIC_DIR,
xstatic_url=tornado_xstatic.url_maker("/xstatic/"),
)
# Serve at http://localhost:8765/ N.B. Leaving out 'localhost' here will
# work, but it will listen on the public network interface as well.
# Given what terminado does, that would be rather a security hole.
app.listen(8765, "localhost")
try:
tornado.ioloop.IOLoop.instance().start()
finally:
term_manager.shutdown()
See the demos
directory for
more examples. This is a simplified version of the single.py demo.
Run the unit tests with:
$ pytest
FAQs
Tornado websocket backend for the Xterm.js Javascript terminal emulator library.
We found that terminado demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 4 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Compromised intercom-client@7.0.4 npm package is tied to the ongoing Mini Shai-Hulud worm attack targeting developer and CI/CD secrets.

Research
Socket detected a malicious supply chain attack on PyPI package lightning versions 2.6.2 and 2.6.3, which execute credential-stealing malware on import.

Research
A brand-squatted TanStack npm package used postinstall scripts to steal .env files and exfiltrate developer secrets to an attacker-controlled endpoint.