
Research
/Security News
Laravel Lang Compromised with RCE Backdoor Across 700+ Versions
Laravel Lang packages were compromised with an RCE backdoor across hundreds of versions, exposing cloud, CI/CD, and developer secrets.
@samooth/brfc
Advanced tools
It is desirable that a BRFC document be uniquely identified. Without a central authority to issue an identification number, we have chosen to borrow inspiration from Bitcoin and use hashes of content.
To construct a BRFC ID from a specification, take the UTF8 string value of the title, author and version metadata fields (omit those not present), trim leading and trailing whitespace (leaving whitespace mid-way through the value), concatenate each value, then reinterpret the string as a byte array, and apply a double SHA256 hash.
let hash = sha256d(
spec.title.trim() +
(spec.author || '').trim() +
(spec.version || '').trim()
);
Hex-format the hash as per Bitcoin conventions (usually this means reversing the bytes before converting to hex).
let bitcoinDisplayHash = hash
.reverse()
.toString('hex');
Take the first 12 characters of the Bitcoin-style display hash (representing the last six bytes of the underlying sha256d value):
let brfcId = bitcoinDisplayHash.substring(0, 12);
Hashing the title, author and version metadata of a specification allows us to generate a unique ID without central authority. Hashing the entire specification was considered, however this was discounted due to the following drawbacks:
title: BRFC Specifications
author: andy (nChain)
version: 1
Expected BRFC ID: 57dd1f54fc67
title: bsvalias Payment Addressing (PayTo Protocol Prefix)
author: andy (nChain)
version: 1
Expected BRFC ID: 74524c4d6274
title: bsvalias Integration with Simplified Payment Protocol
author: andy (nChain)
version: 1
Expected BRFC ID: 0036f9b8860f
You can use this as a command line tool:
yarn cli "Title" "Author" "Version"
const { brfc } = require('@moneybutton/brfc')
console.log(brfc('Title', 'Author', 'Version'))
FAQs
Isomorphic Brfc Implementation.
The npm package @samooth/brfc receives a total of 105 weekly downloads. As such, @samooth/brfc popularity was classified as not popular.
We found that @samooth/brfc demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Laravel Lang packages were compromised with an RCE backdoor across hundreds of versions, exposing cloud, CI/CD, and developer secrets.

Security News
Socket found a malicious postinstall hook across 700+ GitHub repos, including PHP packages on Packagist and Node.js project repositories.

Security News
Vibe coding at scale is reshaping how packages are created, contributed, and selected across the software supply chain