Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Built by The Root Company for Greenlock and ACME.js
Lightweight, Zero-Dependency PEM encoder and decoder.
| ~300b gzipped | ~650b minified | ~1k full |
This library supports PEM, which is pretty boring on its own.
Most likely you are also interested in some of the following:
Want to contribute? Need commercial support?
Parsing
var PEM = require('@root/pem/parser');
var block = PEM.parseBlock(
'-----BEGIN Type-----\nSGVsbG8sIOS4lueVjCE=\n-----END Type-----\n'
);
{
bytes: `<48 65 6c 6c 6f 2c 20 e4 b8 96 e7 95 8c 21>`;
}
Packing
var PEM = require('@root/pem/packer');
var block = PEM.packBlock({
type: 'Type',
// Buffer or Uint8Array or Array
bytes: [0x48, 0x65, 0x6c, 0x6c, 0x6f, 0x2c, 0x20, 0xe4, 0xb8, 0x96, 0xe7, 0x95, 0x8c, 0x21]
);
-----BEGIN Type-----
SGVsbG8sIOS4lueVjCE=
-----END Type-----
This works equally well in Browsers and Node.js, but has slightly different code.
npm install --save @root/pem
var PEM = require('@root/pem');
// just the packer
var PEM = require('@root/pem/packer');
// just the parser
var PEM = require('@root/pem/parser');
<script src="https://unpkg.com/@root/pem/dist/pem.all.js"></script>
<script src="https://unpkg.com/@root/pem/dist/pem.all.min.js"></script>
A Block represents a PEM encoded structure.
The encoded form is:
-----BEGIN Type-----
Headers
base64-encoded Bytes
-----END Type-----
where Headers is a possibly empty sequence of Key: Value lines.
(credit: https://golang.org/pkg/encoding/pem/)
PEM was introduced in 1993 via RFC 1421, but not formally standardized until RFC 7468 in April of 2015.
It has served as the de facto standard for a variety of DER-encoded X509 schemas of ASN.1 data for cryptographic keys and certificates such as:
Did this project save you some time? Maybe make your day? Even save the day?
Please say "thanks" via Paypal or Patreon:
Where does your contribution go?
Root is a collection of experts who trust each other and enjoy working together on deep-tech, Indie Web projects.
Our goal is to operate as a sustainable community.
Your contributions - both in code and especially monetarily - help to not just this project, but also our broader work of projects that fuel the Indie Web.
Also, we chat on Keybase in #rootprojects
Do you need...
Contact aj@therootcompany.com for support options.
Copyright AJ ONeal, Root 2018-2019
MPL-2.0 | Terms of Use | Privacy Policy
FAQs
VanillaJS, Lightweight, Zero-Dependency, PEM encoder and decoder.
We found that @root/pem demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 3 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.