Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
@stonegray/ableton-detect
Advanced tools
Get information from installed Ableton Live instances
ableton-detect
scans application folders and returns an array of all installed Ableton Live instances. For every detected instance, it attempts to read the versions, varients (eg. Suite), architectures, ableton licences, addon licences, serial numbers and more, reporting any issues it encounters.
During scanning, a number of checks are performed to detect broken or damaged installations. Any issues found while running compatibility checks are reported in the output object's .error
array.
This package exports an ES module and requires Node 15+ and macOS.
Basic example:
import getAbletons from '@stonegray/ableton-detect'
console.log(await getAbletons());
Output:
[
{
relPath: 'Ableton Live 10 Lite.app',
absPath: '/Applications/Ableton Live 10 Lite.app',
version: SemVer {
raw: '10.1.25',
major: 10,
minor: 1,
patch: 25,
prerelease: [],
build: [],
version: '10.1.25'
},
fullVersion: '10.1.25 (2020-10-01_995d768242)',
minSystemVersion: '10.11.6',
variant: 'Lite',
icon: '/Applications/Ableton Live 10 Lite.app/Contents/Resources/app.icns',
ok: true,
errors: [],
arch: [ 'x64' ],
addons: [
/* Addon support is experimental and may change! */
],
licence: {
/* Licence support is experimental and may change! */
logicalId: 0,
licenceId: 0,
versionCode: 160,
productId: '04',
serial: '51A8-6AE6-DFDB-8C40-E26E-500F',
distrobutionType: 80,
responseCode: 'AC9F5F44DC8A8D18AFE9A9B2FF7A00407A2543EFD57F1F9E310726723BF7E34493A80D980394449D'
}
]
This library provides experimental support for reading licences. Currently, it provides the following information about the Ableton licence, as well as any installed addons:
0.0.8+
)0.0.11+
)0.0.11+
)Example uses of this information:
Licences are stored in the AB1E5678
(.cfg) files, which I don't have any documentation for. The current code to read the file format works, but needs to be rewriten once we know how to correctly decode the format using the information in the header.
Licences are stored on the system by version, so the licences array for all varients of the same version will share the Addons field.
For testing, an example Ableton serial number, licence database, and activation file (.auz) is provided in ./resources
. This code is for testing only, it won't work to activate Ableton (obviously!)
ableton-detect
uses many macOS specific methods to achieve what it does, such as reading Mach-O headers, parsing Info.plist
files, and reading information in .app
s. These cannot be simply ported to Windows, and retrieving the same information would require a complete rewrite. If somebody else is willing to figure out how to collect the same data on Windows I think it would be great to add support.
ableton-detect
Ableton Licence Backup [npm] [github] Extracts the Ableton licences you currently have activated on your machine, and exports them to an Ableton offline authorization (.auz) file, which can be used to reactivate all of the same products and addons in the future, without using the ableton website.
Made something neat with this library? File an issue or submit a PR!
.arch
array.FAQs
Get information from installed Ableton Live instances
The npm package @stonegray/ableton-detect receives a total of 5 weekly downloads. As such, @stonegray/ableton-detect popularity was classified as not popular.
We found that @stonegray/ableton-detect demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.