Research
Security News
Malicious npm Package Targets Solana Developers and Hijacks Funds
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
Mcpdf is an alternative to PDFtk with fixed unicode issues, so you can write Łódź into your forms.
It implements a small subset of PDFtk for which it implements compatible command line interface, so it can be used as a drop-in replacement for this subset of commands.
Internally it uses the iText PDF library.
Make sure you have installed a Java Runtime Environment such as OpenJDK.
Download the latest standalone version of Mcpdf (jar-with-dependencies).
For the sake of brevity, we will refer to this file as mcpdf.jar
. So you should either rename the file or create a symlink:
ln -s mcpdf-0.2.10-jar-with-dependencies.jar mcpdf.jar
Test it via:
java -jar mcpdf.jar
For the implemented subset of commands (see below), Mcpdf can be used as a drop-in replacement for PDFtk, taking a PDFtk command and replace pdftk
with java -jar mcpdf.jar
.
Please create an issue tracker entry if you would like to add more commands.
Fill in form data from DATA.xfdf
into FORM.pdf
and write the result to OUTPUT.pdf
:
java -jar mcpdf.jar FORM.pdf fill_form - output - < DATA.xfdf > OUTPUT.pdf
Fill in form data and flatten the document to prevent further editing:
java -jar mcpdf.jar FORM.pdf fill_form - output - flatten < DATA.xfdf > OUTPUT.pdf
Use BACKGROUND.pdf
as a background for INPUT.pdf
and output to OUTPUT.pdf
:
java -jar mcpdf.jar INPUT.pdf background BACKGROUND.pdf output - > OUTPUT.pdf
Similarly, you can use the stamp functionality to add STAMP.pdf
as a stamp (i.e. foreground) for INPUT.pdf
and output into OUTPUT.pdf
. This works just like background, except that it places STAMP.pdf
in front of INPUT.pdf
instead of behind it:
java -jar mcpdf.jar INPUT.pdf stamp STAMP.pdf output - > OUTPUT.pdf
Download the plain JAR file (mcpdf-0.2.10.jar
) instead of the jar-with-dependencies.
Download the version of the iText PDF library you want to use (itextpdf-X.Y.Z.jar
).
Run both in combination:
java -cp itextpdf-X.Y.Z.jar:mcpdf-0.2.10.jar aero.m_click.mcpdf.Main
Make sure you have installed Maven and Git.
Download the latest Mcpdf source and change into that folder:
git clone https://github.com/m-click/mcpdf.git
cd mcpdf
Build the plain JAR file as well as the jar-with-dependencies:
mvn package
This will download the correct version of the iText PDF library and all required Maven modules automatically.
You will find the JAR files in the target
subfolder.
Mcpdf uses the Sonatype OSSRH (OSS Repository Hosting Service). The project creation ticket was OSSRH-8759.
Create ~/.m2/settings.xml
:
<settings>
<servers>
<server>
<id>sonatype-nexus-snapshots</id>
<username>...</username>
<password>...</password>
</server>
<server>
<id>sonatype-nexus-staging</id>
<username>...</username>
<password>...</password>
</server>
</servers>
</settings>
Prepare documentation:
VERSION=`sed -n 's/^ <version>\([^-]*\).*/\1/p' pom.xml`
sed -i "s,mcpdf\([-/]\)[0-9.]*[0-9],mcpdf\1$VERSION,g" README.md
git commit -m "Prepare documentation for release mcpdf-$VERSION" README.md
Create a new release and upload it to the OSSRH staging area:
mvn release:clean release:prepare release:perform && git push
In case this fails with an error message stating that javadoc
cannot be found, try setting JAVA_HOME
:
export JAVA_HOME=/usr && mvn release:clean release:prepare release:perform && git push
If the automatic deployment failed:
Staging Repositories
Refresh
a few times as neededClose
, then Confirm
Refresh
a few times as neededRelease
, then Confirm
Watch it appear at the Central Repository:
FAQs
Mcpdf is a drop-in replacement for PDFtk.
We found that aero.m-click:mcpdf demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
Security News
Research
Socket researchers have discovered malicious npm packages targeting crypto developers, stealing credentials and wallet data using spyware delivered through typosquats of popular cryptographic libraries.
Security News
Socket's package search now displays weekly downloads for npm packages, helping developers quickly assess popularity and make more informed decisions.