Research
Security News
Malicious npm Package Targets Solana Developers and Hijacks Funds
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
@planet-a/avsc-zstandard-codec
Advanced tools
Zstandard
codec for avsc
npm i @planet-a/avsc-zstandard-codec
or
yarn add @planet-a/avsc-zstandard-codec
import Avro from "avsc";
import {
createDecoderMixin,
createEncoderMixin,
codecName,
} from "@planet-a/avsc-zstandard-codec";
const mySchema = Avro.Type.forSchema({ type: "string" });
{
// encode
const fileEncoder = Avro.createFileEncoder("./my.avro", mySchema, {
codec: codecName,
codecs: {
...Avro.streams.BlockEncoder.defaultCodecs(),
...createEncoderMixin(),
},
})
.write("Hello")
.write("World")
.end();
await finished(fileEncoder);
}
{
// decode
const fileDecoder = Avro.createFileDecoder("./my.avro", {
codecs: {
...Avro.streams.BlockEncoder.defaultCodecs(),
...createDecoderMixin(),
},
}).on("data", console.log.bind(console));
await finished(fileDecoder);
}
@mongodb-js/zstd
?It uses the @mongodb-js/zstd package, as this package has a few advantages:
decompress
function does not need the uncompressed buffer size in advance, a restriction which most other WASM-based implementations have and renders them unusable for this taskBuffer
. Whilst a Uint8Array
implementation would be more portable (I am looking at you, Deno), avsc@5.7
itself is using Buffer
. https://github.com/mtth/avsc/pull/452 has landed, so we might have some more options of what packages to use once we drop avsc@5.7.x
support.Snowflake
compatibilityYou'll see that the current implementation uses defaults from the Avro repository.
Namely:
zstandard
the file won't be readable at all)Could not read file
)).The reason for that is, that in order to make the Avro export as portable as possible, we need to make sure that none of these things need to be specified. A prime example of that is for example Snowflake's Avro support (COPY INTO
). Specifically, if you alter the codec name and/or the checksum flag, you won't be able to use the generated Avro files via their product.
FAQs
A `zstandard` codec for `avsc`
The npm package @planet-a/avsc-zstandard-codec receives a total of 2 weekly downloads. As such, @planet-a/avsc-zstandard-codec popularity was classified as not popular.
We found that @planet-a/avsc-zstandard-codec demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
Security News
Research
Socket researchers have discovered malicious npm packages targeting crypto developers, stealing credentials and wallet data using spyware delivered through typosquats of popular cryptographic libraries.
Security News
Socket's package search now displays weekly downloads for npm packages, helping developers quickly assess popularity and make more informed decisions.