Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
It is a tool that invoke AWS Lambda function from the local machine as a normally script.
Add this line to your application's Gemfile:
gem 'lambchop'
And then execute:
$ bundle
Or install it yourself as:
$ gem install lambchop
Terminal 1:
$ export AWS_ACCESS_KEY_ID=...
$ export AWS_SECRET_ACCESS_KEY=...
$ export AWS_REGION=us-east-1
$ cat test.js
#!/usr/bin/env lambchop
/*
function_name: test # default: file name without ext
runtime: nodejs # default: nodejs
description: '' # default: (empty)
timeout: 3 # default: 3
memory_size: 128 # default: 128
role: arn:aws:iam::NNNNNNNNNNNN:role/lambda_exec_role
handler: test.handler
include_files: */* # default: nil
# Handler module name is filename.
# `handler:` is `index.handler` when filename is `index.js`
*/
console.log('Loading event');
exports.handler = function(event, context) {
console.log('value1 = ' + event.key1);
console.log('value2 = ' + event.key2);
console.log('value3 = ' + event.key3);
context.succeed('Hello World');
};
$ ./test.js
(Wait event...)
Terminal 2:
$ export AWS_ACCESS_KEY_ID=...
$ export AWS_SECRET_ACCESS_KEY=...
$ export AWS_REGION=us-east-1
$ lambchop-cat
usage: lambchop-cat <function-name>
$ echo '{"key1":100, "key2":200, "key3":300}' | lambchop-cat test
---
status_code: 200
function_error:
payload: '"Hello World"'
Terminal 1:
(Wait event...)
2014-11-23T08:06:53.212Z xxxxxxxxxxxxxxxx Loading event
START RequestId: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
2014-11-23T08:06:53.330Z xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx value1 = 100
2014-11-23T08:06:53.330Z xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx value3 = 300
2014-11-23T08:06:53.330Z xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx value2 = 200
END RequestId: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
REPORT RequestId: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx Duration: 117.54 ms Billed Duration: 200 ms Memory Size: 128 MB Max Memory Used: 9 MB
$ echo '{"key1":100, "key2":200, "key3":300}' | lambchop-cat test -t event
---
status_code: 202
function_error:
payload: ''
$ echo '{"key1":100, "key2":200, "key3":300}' | lambchop-cat test -l tail
status_code: 200
function_error:
payload: '"Hello world!"'
log_result: |-
2014-11-23T08:06:53.212Z xxxxxxxxxxxxxxxx Loading event
START RequestId: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
2014-11-23T08:06:53.330Z xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx value1 = 100
2014-11-23T08:06:53.330Z xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx value3 = 300
2014-11-23T08:06:53.330Z xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx value2 = 200
END RequestId: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
REPORT RequestId: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx Duration: 117.54 ms Billed Duration: 200 ms Memory Size: 128 MB Max Memory Used: 9 MB
$ echo '{"key1":100, "key2":200, "key3":300}' | lambchop-cat test -t dry_run
---
status_code: 204
function_error:
payload: ''
$ lambchop-dump
usage: lambchop-dump <function-name>
$ lambchop-dump test
#!/usr/bin/env lambchop
/*
function_name: test
runtime: nodejs
role: arn:aws:iam::NNNNNNNNNNNN:role/lambda_exec_role
handler: test.handler
description: ''
timeout: 3
memory_size: 128
*/
console.log('Loading event');
exports.handler = function(event, context) {
console.log('value1 = ' + event.key1);
console.log('value2 = ' + event.key2);
console.log('value3 = ' + event.key3);
context.succeed('Hello World');
};
#!/usr/bin/env lambchop -d
...
#!/usr/bin/env lambchop -e
...
~$ lambchop-tail
usage: lambchop-tail <function-name>
~$ lambchop-tail test
START RequestId: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
...
.
├── lambda-script.js
└── node_modules/
#!/usr/bin/env lambchop
/*
...
include_files: *.txt
*/
...
$ lambchop-diff
usage: lambchop-cat <function-name> <file>
$ lambchop-diff test ./test.js
--- test:test.js
+++ ./test.js
@@ -1,11 +1,11 @@
var http = require('http');
exports.handler = function(event, context) {
- http.get('http://example.com/', function(res) {
+ http.get('http://www.yahoo.com/', function(res) {
res.setEncoding('utf8');
res.on('data', function(str) {
console.log(str);
context.done();
});
});
};
FAQs
Unknown package
We found that lambchop demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.