Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
@mobylogix/node-random
Advanced tools
The random
package provides several functions for generating random
numbers. It uses a cryptographically strong pseudorandom number generator when
possible, but falls back to a weaker random number generator when
cryptographically strong randomness is not available (on older browsers or on
servers that don't have enough entropy to seed the cryptographically strong
generator).
Random.id([n])
- Returns a unique identifier, such as "Jjwjg6gouWLXhMGKW"
, that is
likely to be unique in the whole world. The optional argument n
specifies the length of the identifier in characters and defaults to 17.
Random.secret([n])
- Returns a random string of printable characters with 6 bits of
entropy per character. The optional argument n
specifies the length of
the secret string and defaults to 43 characters, or 256 bits of
entropy. Use Random.secret
for security-critical secrets that are
intended for machine, rather than human, consumption.
Random.fraction()
- Returns a number between 0 and 1, like Math.random
.
Random.choice(arrayOrString)
- Returns a random element of the given array or string.
Random.hexString(n)
- Returns a random string of n
hexadecimal digits.
FAQs
Node random package similar to meteor random package
We found that @mobylogix/node-random demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.