Research
Security News
Malicious npm Package Targets Solana Developers and Hijacks Funds
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
github.com/balacode/one-file-pdf
The main idea behind this project was:
"How small can I make a PDF generator for it to still be useful for 80% of common PDF generation needs?"
The result is a single .go file with less than 1999 lines of code, about 400 of which are color and glyph-size constants, and ~350 are comments.
go get github.com/balacode/one-file-pdf
All types in are prefixed with PDF for public, and 'pdf' for private types. The only type you need to use is PDF, while PDFColorNames are left public for reference.
package main
import (
"fmt"
"github.com/balacode/one-file-pdf"
)
func main() {
fmt.Println(`Generating a "Hello World" PDF...`)
// create a new PDF using 'A4' page size
var pdf = pdf.NewPDF("A4")
// set the measurement units to centimeters
pdf.SetUnits("cm")
// draw a grid to help us align stuff (just a guide, not necessary)
pdf.DrawUnitGrid()
// draw the word 'HELLO' in orange, using 100pt bold Helvetica font
// - text is placed on top of, not below the Y-coordinate
// - you can use method chaining
pdf.SetFont("Helvetica-Bold", 100).
SetXY(5, 5).
SetColor("Orange").
DrawText("HELLO")
// draw the word 'WORLD' in blue-violet, using 100pt Helvetica font
// note that here we use the colo(u)r hex code instead
// of its name, using the CSS/HTML format: #RRGGBB
pdf.SetXY(5, 9).
SetColor("#8A2BE2").
SetFont("Helvetica", 100).
DrawText("WORLD!")
// draw a flower icon using 300pt Zapf-Dingbats font
pdf.SetX(7).SetY(17).
SetColorRGB(255, 0, 0).
SetFont("ZapfDingbats", 300).
DrawText("a")
// save the file:
// if the file exists, it will be overwritten
// if the file is in use, prints an error message
pdf.SaveFile("hello.pdf")
} // main
Click on a sample to see the PDF in more detail.
These are the most recent changes in the functionality of the package, not including internal changes which are best seen in the commits history.
2018-04-14
zapf_dingbats_table.pdf
.
You can use this table to look up the hex code for each icon.See changelog.md for changes made earlier.
FAQs
Unknown package
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
Security News
Research
Socket researchers have discovered malicious npm packages targeting crypto developers, stealing credentials and wallet data using spyware delivered through typosquats of popular cryptographic libraries.
Security News
Socket's package search now displays weekly downloads for npm packages, helping developers quickly assess popularity and make more informed decisions.