Research
Security News
Quasar RAT Disguised as an npm Package for Detecting Vulnerabilities in Ethereum Smart Contracts
Socket researchers uncover a malicious npm package posing as a tool for detecting vulnerabilities in Etherium smart contracts.
github.com/loveholidays/excalidraw-decrypt
CLI tool and library that allows fetching Excalidraw diagrams as Plain text from the Excalidraw public API, which can be used for storage and combined with other tools to render the diagrams.
The library relies on the parameters obtained from Excalidraw shareable links, which have the following format
https://excalidraw.com/#json=documentID,decryptionKey
go install github.com/loveholidays/excalidraw-decrypt/cmd/excalidraw-decrypt@latest
brew install loveholidays/tap/excalidraw-decrypt
Grab the latest OS/Arch compatible binary from our Releases page.
Given an Excalidraw shareable link, for example https://excalidraw.com/#json=pJK6JcJMr7LGOuy1NbCKP,YneEARvxllEU6vlDQfz81A
you just need to run the tool in the command line, passing as an argument from the URL after #json=
.
excalidraw-decrypt pJK6JcJMr7LGOuy1NbCKP,YneEARvxllEU6vlDQfz81A > my_diagram.excalidraw
Simply create a decrypter client and pass the same argument as a single string. Find an example on this codebase.
decrypter := excalidrawdecrypt.CreateShareableExcalidrawDecrypter()
plaintext, err := decrypter.Decrypt("pJK6JcJMr7LGOuy1NbCKP,YneEARvxllEU6vlDQfz81A")
You can import back the fetched plaintext diagram to excalidraw to continue editing, opening the file in Excalidraw
To continue editing the original document, simply visit the Excalidraw shareable link in a browser
Requires go 1.22.2. Running make build
will create an excalidraw-decrypt
binary in the bin
directory.
Using a public Excalidraw API to download the ciphered diagram:
https://json.excalidraw.com/api/v2/documentID
The downloaded diagram is decrypted using the decryptionKey from the shareable link.
The diagram in this shareable link paints the picture of the steps required to get the Excalidraw file in plaintext: https://excalidraw.com/#json=pJK6JcJMr7LGOuy1NbCKP,YneEARvxllEU6vlDQfz81A
FAQs
Unknown package
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket researchers uncover a malicious npm package posing as a tool for detecting vulnerabilities in Etherium smart contracts.
Security News
Research
A supply chain attack on Rspack's npm packages injected cryptomining malware, potentially impacting thousands of developers.
Research
Security News
Socket researchers discovered a malware campaign on npm delivering the Skuld infostealer via typosquatted packages, exposing sensitive data.