Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
com.github.glusk:caesar
Advanced tools
An object-oriented approach to cryptography in Java.
This project aims to replace/wrap the following JDK APIs:
MessageDigest
,
Mac
and
Cipher
.
cactoos-crypto is a direct alternative to this project.
In order to start using Caesar's hashing utilities you first have to wrap a MessageDigest
instance inside a new ImmutableMessageDigest
object:
ImmutableMessageDigest imd =
new ImmutableMessageDigest(
MessageDigest.getInstance(/* ... */)
);
Once you obtain an ImmutableMessageDigest
instance, you can perform the hashing:
// ImmutableMessageDigest imd = ...
Bytes result = new Hash(imd, new PlainText("password123"));
You can also use ImmutableMessageDigest
's fluid API:
// ImmutableMessageDigest imd = ...
byte[] result = imd.update(new PlainText("password123")).digest();
You can pass the result of one hashing operation as an argument to another.
Suppose we wanted to compute the following hash:
H(H(b1), b2, b3)
This is how it would be done with Caesar:
// byte[] b1 = ...
// byte[] b2 = ...
// byte[] b3 = ...
// ImmutableMessageDigest imd = ...
Bytes result =
new Hash(
imd,
new Hash(
imd,
() -> b1
),
() -> b2,
() -> b3
);
This is how you compute HMAC("Key", "Message")
with Caesar, using the
SHA-256
hash function:
Bytes hmac =
new Hmac(
new ImmutableMessageDigest(
MessageDigest.getInstance("SHA-256")
),
new PlainText("Key"),
new PlainText("Message")
);
Use the release script with the following arguments:
release
- the next release version
snapshot
- the next snapshot version
dryRun
(optional) - if set to true
, the changes will not be pushed
to the remote repository
Example:
./release.sh 0.1.1 0.1.2-SNAPSHOT
FAQs
An object-oriented approach to cryptography in Java.
We found that com.github.glusk:caesar demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.