Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Seijaku is a program that allows you to execute shell commands listed in YAML payload files, ensuring that they are executed correctly. It includes a lightweight scheduler that will take care of executing payloads with specific delay between two executions.
Payloads are YAML files that describe the various tasks Seijaku will have to perform (in order). Each task contains one or more steps.
A step is a shell command to be executed. Seijaku currently supports the following shells: bash, sh and ssh.
Each task can have "pre" and "post" tasks, for example to create and delete folders, or install and uninstall software needed to run a task.
A step sometimes needs variables in order to be performed correctly: Seijaku supports the direct definition of variables or from an environment variable of the shell running Seijaku.
A scheduler is a file listing payloads that must be executed with unique specifications: a name, a delay between two runs and the path to the concerned payload.
name: my payload
ssh:
- host: my-host
user: user
port: 22
variables:
MY_VARIABLE: a static variable
MY_ENV_VARIABLE: $MY_ENV_VARIABLE
tasks:
- name: do something useful
steps:
- sh: echo "$MY_VARIABLE" # "a static variable"
- bash: echo "$MY_ENV_VARIABLE" # given from executive shell
- name: task with more settings
pre:
- sh: "do something before"
steps:
- sh: echo "$MY_VARIABLE"
output: true
- sh: echo "something" && exit 1
soft_fail: true
post:
- sh: "do something after"
- name: task with SSH executor
host: my-host
steps:
- ssh: echo "executed on host"
name: my-scheduler
payloads:
- payload: ./test/my-payload.yaml
name: My test Payload
every: 3600 # executed every hour
- payload: ./test/another-payload.yaml
name: Another payload
every: 60 # executed every minute
Install Seijaku using Gem:
gem install seijaku
seijaku -h
seijaku -f ./my-payload.yaml # one-time payload execution
seijaku -s ./my-scheduler.yaml # recurrent payloads execution with delay
FAQs
Unknown package
We found that seijaku demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.