Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
This is a simple command line tool for writing input from the client to a remote jabber server and outputting to the console.
The command line tool can be installed with:
gem install jabber-tee
The general idea is that you can pipe anything from the console into this, and it will be sent to the remote jabber server:
cat huge_text_file.txt | jabber-tee -u peon@bigcorp.com --room working-hard@rooms.bigcorp.com --nick 'Worker Drone'
or
echo "I am $(whoami) at $(hostname)" | jabber-tee --to somebody@somewhere.com
Alternatively, you can supply a list of arguments that will be run as a command, which is essentially equivalent:
jabber-tee --to somebody@somewhere.com -- echo "I am $(whoami) at $(hostname)"
Because entering the same information on the command line for this thing can be tedious, you can create a ~/.jabber-tee.yml file that fills in all of the basic configuration. This file also allows you to further customize the output that is sent to the jabber server.
An example configuration file:
# Global configuration values:
username: my.name@jabber.org
nick: 'Gabe'
# Individual profiles that customize global variables
profiles:
new-hotness:
# Uses the standard username, above
nick: 'Mr. Super Cool'
room: 'HipCentral'
password: 'secret'
somebody.else:
username: supercooldude@gmail.com
nick: 'Rocksteady Gabe'
to: somebody.else@gmail.com
work-stuff:
username: peon@bigcorp.com
nick: 'Worker Drone'
room: working-hard@rooms.bigcorp.com
You can then activate these individual profiles from the command line with the '-P' flag. So, the above command could be replaced with:
cat huge_text_file.txt | jabber-tee -P work-stuff
FAQs
Unknown package
We found that jabber-tee demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.