
Research
Malicious fezbox npm Package Steals Browser Passwords from Cookies via Innovative QR Code Steganographic Technique
A malicious package uses a QR code as steganography in an innovative technique.
@deskeen/web-builder-add-hash-filename
Advanced tools
This module allows the @deskeen/web-builder to add the file hash to the file names.
npm install @deskeen/web-builder
npm install @deskeen/web-builder-add-hash-filename
Add the module to the list of modules:
const builder = require('@deskeen/web-builder')
await builder.build({
source: [
// List of files or directories that include inlineSVG tags
// {{inlineJSON:file.json}}
],
modules: [
[
'@deskeen/web-builder-add-hash-filename',
{
// Starting points
// Can be a function or a list of files
entries: file => file.endsWith('.html'),
assets: [
// List of directories that include the files
// noted in the addHash tags
],
}
]
]
})
Let's consider the following files:
/www/index.html
<!DOCTYPE html>
<html>
<head>
<meta charset="utf-8">
<link href="{{addHash:style.css}}" rel="stylesheet" type="text/css">
<title>Pink is the new Black</title>
</head>
<body>
<!-- My cool page -->
</body>
</html>
/www/css/style.css
body {
background-color: pink;
}
Build the project by running:
await builder.build({
source: ['/www'],
modules: [
[
'@deskeen/web-builder-add-hash-filename',
{
entries: file => file.endsWith('.html'),
assets: ['/www/css'],
}
]
]
})
Two things happen:
<link href="style.cb163438387622e1354d9613a8f44dfa.css"
style.cb163438387622e1354d9613a8f44dfa.css
You can reach me at {my_firstname}@{my_name}.fr
MIT Licence - Copyright (c) Morgan Schmiedt
FAQs
Web Builder Module - Add Hash to Filename
We found that @deskeen/web-builder-add-hash-filename demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
A malicious package uses a QR code as steganography in an innovative technique.
Research
/Security News
Socket identified 80 fake candidates targeting engineering roles, including suspected North Korean operators, exposing the new reality of hiring as a security function.
Application Security
/Research
/Security News
Socket detected multiple compromised CrowdStrike npm packages, continuing the "Shai-Hulud" supply chain attack that has now impacted nearly 500 packages.