Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
github.com/umahmood/perceptive
Perceptive is a Go library which implements perceptual hash algorithms for comparing images.
Perceptual hash algorithms are a family of comparable hash functions which generate distinct (but not unique) fingerprints, these fingerprints are then comparable.
Perceptual hash algorithms are mainly used for detecting duplicates of the same files, in a way that standard and cryptographic hashes generally fail.
Note: This library can only compute hashes for images, it does not work on audio or video files.
Currently, the following perceptual hash algorithms are implemented:
Perceptual hash algorithms can give false positives, but there main aim is to give you a sense of similarity between files.
Perceptual hash algorithms tend to return a distance score. When comparing the two identical images below, we would receive a distance of 0:
A distance of zero means that the images are likely the same.
When comparing the two similar images below we would receive a distance between 1-10 (depending on the hashing technique used):
A distance between 1-10 indicates the images are likely a variation of each other.
When comparing the two different images below we would receive a distance greater than 10:
A distance greater than 10 indicates the images are likely different.
Remember perceptual hash algorithms can give false positives.
go get github.com/umahmood/perceptive
cd $GOPATH/src/github.com/umahmood/perceptive
go test ./...
package main
import (
"log"
"github.com/disintegration/imaging"
"github.com/umahmood/perceptive"
)
func openImage(filePath string) image.Image {
img, err := imaging.Open(filePath)
if err != nil {
log.Fatalln(err)
}
return img
}
func main() {
imgA := openImage("lena.jpg")
imgB := openImage("lena.jpg")
distance, err := perceptive.CompareImages(imgA, imgB, perceptive.Difference)
if distance == 0 {
// images are likely the same
} else if distance >= 1 && distance <= 10 {
// images are potentially a variation
} else {
// images are likely different
}
}
See the LICENSE file for license rights and limitations (MIT).
FAQs
Unknown package
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.