
Research
/Security News
Critical Vulnerability in NestJS Devtools: Localhost RCE via Sandbox Escape
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
@huggingface/gearhash-wasm
Advanced tools
JS and WASM implementations of https://github.com/srijs/rust-gearhash
JS and WASM implementations of https://github.com/srijs/rust-gearhash
Using AssemblyScript to generate a lean WASM.
import { nextMatch } from '@huggingface/gearhash-wasm';
// Create a Uint8Array of data to search through
const data = new Uint8Array(1000000); // Example: 1MB of data
// ... fill data with your content ...
const mask = 0x0000d90003530000n; // Example mask as a BigInt, more 1s in binary repr => bigger chunks
//^ it has 11 1s in binary, so chunks will be ~2048 long
const match = nextMatch(data, mask);
const allMatches = nextMatches(data, mask).matches;
The nextMatch
function takes two parameters:
data
: A Uint8Array containing the data to search throughmask
: A BigInt, the more 1s it has in its binary representation, the bigger the chunkThe function returns an object with the position
(i32) and hash
(u64) properties
You can continuously feed data like this:
let hash = 0n;
const mask = 0x0000d90003530000n;
let length = 0; // extra length not processed
for await (const chunk of dataSource) {
let index = 0;
while (1) {
let match = nextMatch(chunk.subArray(index), mask, hash);
if (match.position !== -1) {
console.log({
length: match.position + length,
hash: match.hash
})
index += match.position;
length = 0;
hash = 0n;
} else {
length += chunk.length - index;
break;
}
}
}
console.log(length, "bytes without a match, ending hash: ", hash);
or, more performant with nextMatches
:
let hash = 0n;
const mask = 0x0000d90003530000n;
let length = 0;
for await (const chunk of dataSource) {
const result = nextMatches(chunk, mask, hash);
let lastPosition = 0;
for (const match of result.matches) {
console.log({
length: match.position - lastPosition + length,
hash: match.hash
});
length = 0;
lastPosition = match.position;
}
length = result.remaining;
hash = result.hash;
}
console.log(length, "bytes without a match, ending hash: ", hash);
SIMD
FAQs
JS and WASM implementations of https://github.com/srijs/rust-gearhash
The npm package @huggingface/gearhash-wasm receives a total of 1 weekly downloads. As such, @huggingface/gearhash-wasm popularity was classified as not popular.
We found that @huggingface/gearhash-wasm demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 4 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
Product
Customize license detection with Socket’s new license overlays: gain control, reduce noise, and handle edge cases with precision.
Product
Socket now supports Rust and Cargo, offering package search for all users and experimental SBOM generation for enterprise projects.