Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
@moneybutton/brfc
Advanced tools
It is desirable that a BRFC document be uniquely identified. Without a central authority to issue an identification number, we have chosen to borrow inspiration from Bitcoin and use hashes of content.
To construct a BRFC ID from a specification, take the UTF8 string value of the title
, author
and version
metadata fields (omit those not present), trim leading and trailing whitespace (leaving whitespace mid-way through the value), concatenate each value, then reinterpret the string as a byte array, and apply a double SHA256 hash.
let hash = sha256d(
spec.title.trim() +
(spec.author || '').trim() +
(spec.version || '').trim()
);
Hex-format the hash as per Bitcoin conventions (usually this means reversing the bytes before converting to hex).
let bitcoinDisplayHash = hash
.reverse()
.toString('hex');
Take the first 12 characters of the Bitcoin-style display hash (representing the last six bytes of the underlying sha256d
value):
let brfcId = bitcoinDisplayHash.substring(0, 12);
Hashing the title, author and version metadata of a specification allows us to generate a unique ID without central authority. Hashing the entire specification was considered, however this was discounted due to the following drawbacks:
title: BRFC Specifications
author: andy (nChain)
version: 1
Expected BRFC ID: 57dd1f54fc67
title: bsvalias Payment Addressing (PayTo Protocol Prefix)
author: andy (nChain)
version: 1
Expected BRFC ID: 74524c4d6274
title: bsvalias Integration with Simplified Payment Protocol
author: andy (nChain)
version: 1
Expected BRFC ID: 0036f9b8860f
You can use this as a command line tool:
yarn cli "Title" "Author" "Version"
const { brfc } = require('@moneybutton/brfc')
console.log(brfc('Title', 'Author', 'Version'))
FAQs
Money Button isomorphic brfc implementation.
We found that @moneybutton/brfc demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 3 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.