Research
Security News
Malicious npm Package Targets Solana Developers and Hijacks Funds
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
github.com/yhy0/fuckfingerprint
Web指纹采取在线获取的方式,这样就可以不用更新程序即可使用最新的指纹,可以很方便的集成进扫描器中。
默认会使用在线的指纹,当在线获取失败时才会使用内置的指纹。
在线指纹依托于 raw.githubusercontent.com ,对于国内不友好可以通过指定代理获取(注:指定代理后,指纹识别也会走代理)
在线指纹地址可以在 pkg/config/config.go
中修改为原项目中的地址
const EHoleFingerDataOnline = "https://raw.githubusercontent.com/veo/vscan/main/pkg/fingerprint/dicts/eHoleFinger.json"
const LocalFingerDataOnline = "https://raw.githubusercontent.com/veo/vscan/main/pkg/fingerprint/dicts/localFinger.json"
const AfrogFingerDataOnline = "https://raw.githubusercontent.com/zan8in/afrog/main/pkg/fingerprint/web_fingerprint_v3.json"
默认使用本项目地址
const EHoleFingerDataOnline = "https://raw.githubusercontent.com/yhy0/FuckFingerprint/main/fingerPrints/eHoleFinger.json"
const LocalFingerDataOnline = "https://raw.githubusercontent.com/yhy0/FuckFingerprint/main/fingerPrints/localFinger.json"
const AfrogFingerDataOnline = "https://raw.githubusercontent.com/yhy0/FuckFingerprint/main/fingerPrints/web_fingerprint_v3.json"
指纹直接提取缝合了以下两个扫描器:
感谢大佬无私奉献
本工具仅面向合法授权的企业安全建设行为,在使用本工具进行检测时,您应确保该行为符合当地的法律法规,并且已经取得了足够的授权。
如您在使用本工具的过程中存在任何非法行为,您需自行承担相应后果,作者将不承担任何法律及连带责任。
在使用本工具前,请您务必审慎阅读、充分理解各条款内容,限制、免责条款或者其他涉及您重大权益的条款可能会以加粗、加下划线等形式提示您重点注意。 除非您已充分阅读、完全理解并接受本协议所有条款,否则,请您不要使用本工具。您的使用行为或者您以其他任何明示或者默示方式表示接受本协议的,即视为您已阅读并同意本协议的约束。
FAQs
Unknown package
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
Security News
Research
Socket researchers have discovered malicious npm packages targeting crypto developers, stealing credentials and wallet data using spyware delivered through typosquats of popular cryptographic libraries.
Security News
Socket's package search now displays weekly downloads for npm packages, helping developers quickly assess popularity and make more informed decisions.