Research
Security News
Kill Switch Hidden in npm Packages Typosquatting Chalk and Chokidar
Socket researchers found several malicious npm packages typosquatting Chalk and Chokidar, targeting Node.js developers with kill switches and data theft.
@protontech/mimemessage
Advanced tools
MIME messages for JavaScript (RFC 2045 & 2046).
Suitable for parsing and generating MIME messages, allowing access to headers and body, including multipart messages such as:
From: Nathaniel Borenstein <nsb@bellcore.com>
To: Ned Freed <ned@innosoft.com>
Date: Sun, 21 Mar 1993 23:56:48 -0800 (PST)
Subject: Sample message
MIME-Version: 1.0
Content-type: multipart/mixed; boundary="simple boundary"
--simple boundary
This is implicitly typed plain US-ASCII text.
It does NOT end with a linebreak.
--simple boundary
Content-type: text/plain; charset=us-ascii
This is explicitly typed plain US-ASCII text.
It DOES end with a linebreak.
--simple boundary--
NOTE: This library is not intended for mail parsing (there are tons of MIME related Node libraries for that). In fact, it does not deal with encodings different that UTF-8. The purpose of this library is to be used in pure browser/Node environments in which MIME messages are useful to transmit data.
$ npm install mimemessage --save
And then:
var mimemessage = require('mimemessage');
The browserified version of the library at dist/mimemessage.js
exposes the global window.mimemessage
module.
<script type='text/javascript' src='js/mimemessage.js'></script>
Let's build a complex multipart MIME message with the following content:
var mimemessage = require('mimemessage');
var msg, alternateEntity, htmlEntity, plainEntity, pngEntity;
// Build the top-level multipart MIME message.
msg = mimemessage.factory({
contentType: 'multipart/mixed',
body: []
});
msg.header('Message-ID', '<1234qwerty>');
// Build the multipart/alternate MIME entity containing both the HTML and plain text entities.
alternateEntity = mimemessage.factory({
contentType: 'multipart/alternate',
body: []
});
// Build the HTML MIME entity.
htmlEntity = mimemessage.factory({
contentType: 'text/html;charset=utf-8',
body: '<p>This is the <strong>HTML</strong> version of the message.</p>'
});
// Build the plain text MIME entity.
plainEntity = mimemessage.factory({
body: 'This is the plain text version of the message.'
});
// Build the PNG MIME entity.
pngEntity = mimemessage.factory({
contentType: 'image/png',
contentTransferEncoding: 'base64',
body: 'fVkVvYassFAAAABQAAAAIAAAAbWltZXR5cG=='
});
pngEntity.header('Content-Disposition', 'attachment ;filename="mypicture.png"');
// Add both the HTML and plain text entities to the multipart/alternate entity.
alternateEntity.body.push(htmlEntity);
alternateEntity.body.push(plainEntity);
// Add the multipart/alternate entity to the top-level MIME message.
msg.body.push(alternateEntity);
// Add the PNG entity to the top-level MIME message.
msg.body.push(pngEntity);
By calling msg.toString()
it produces the following MIME formatted string:
Content-Type: multipart/mixed;boundary=92ckNGfS
Message-Id: <1234qwerty>
--92ckNGfS
Content-Type: multipart/alternate;boundary=EVGuDPPT
--EVGuDPPT
Content-Type: text/html;charset=utf-8
<p>This is the <strong>HTML</strong> version of the message.</p>
--EVGuDPPT
Content-Type: text/plain;charset=utf-8
This is the plain text version of the message.
--EVGuDPPT--
--92ckNGfS
Content-Type: image/png
Content-Transfer-Encoding: base64
Content-Disposition: attachment ;filename="mypicture.png"
fVkVvYassFAAAABQAAAAIAAAAbWltZXR5cG==
--92ckNGfS--
You can read the full API documentation in the docs folder.
Run once,
$ npm test
Watch mode:
$ npm run test -- -w
The library includes the Node debug module. In order to enable debugging:
In Node set the DEBUG=mimemessage*
environment variable before running the application, or set it at the top of the script:
process.env.DEBUG = 'mimemessage*';
In the browser run mimemessage.debug.enable('mimemessage*');
and reload the page. Note that the debugging settings are stored into the browser LocalStorage. To disable it run mimemessage.debug.disable('mimemessage*');
.
You can also set the envia the console, ex:
DEBUG=mimemessage:* npm run test -- -w
Iñaki Baz Castillo Kay Lukas ProtonMail team
MIT :)
FAQs
MIME messages for JavaScript (RFC 2045 & 2046)
The npm package @protontech/mimemessage receives a total of 594 weekly downloads. As such, @protontech/mimemessage popularity was classified as not popular.
We found that @protontech/mimemessage demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 3 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket researchers found several malicious npm packages typosquatting Chalk and Chokidar, targeting Node.js developers with kill switches and data theft.
Security News
pnpm 10 blocks lifecycle scripts by default to improve security, addressing supply chain attack risks but sparking debate over compatibility and workflow changes.
Product
Socket now supports uv.lock files to ensure consistent, secure dependency resolution for Python projects and enhance supply chain security.