
Research
Two Malicious Rust Crates Impersonate Popular Logger to Steal Wallet Keys
Socket uncovers malicious Rust crates impersonating fast_log to steal Solana and Ethereum wallet keys from source code.
@swimlane/docker-reference
Advanced tools
A small package to parse and work with docker images references.
To use docker-reference you should start with creating a Reference
instance:
const { Reference } = require('@swimlane/docker-reference');
const imageReference = new Reference({
domain: 'r.cfcr.io',
repository: 'codefresh/demochat',
tag: 'master',
digest: 'sha256:58fe87ff24d5a3ac35c887dcef82eb619565987c1083282f876c7c2657a5f94e'
});
console.log(imageReference.repositoryUrl); // r.cfcr.io/codefresh/demochat
console.log(imageReference.toString()); // r.cfcr.io/codefresh/demochat:master@sha256:58fe87ff24d5a3ac35c887dcef82eb619565987c1083282f876c7c2657a5f94e
You can also use parser to create your Reference
instance:
const { parseQualifiedName } = require('@swimlane/docker-reference');
const imageReference = parseQualifiedName('r.cfcr.io/codefresh/demochat:master@sha256:58fe87ff24d5a3ac35c887dcef82eb619565987c1083282f876c7c2657a5f94e');
console.log(imageReference.domain); // r.cfcr.io
console.log(imageReference.repository); // codefresh/demochat
console.log(imageReference.tag); // master
console.log(imageReference.digest); // sha256:58fe87ff24d5a3ac35c887dcef82eb619565987c1083282f876c7c2657a5f94e
There are 3 parsers in the package:
parseQualifiedName
:
This should be use when parsing a string representing a qualified image reference, meaning the string should contain at least the domain and the repository of the image.
parseFamiliarName
:
This should be use when parsing a string representing a familiar image
reference, meaning the string might not contains the domain part and this
case the domain part would become docker.io
. Also when the domain is
missing and the repository contains only one part the repository would be
prefixed with library/
.
This parser would parse all qualified image reference the same as
parseQualifiedName
parser
parseAll
:
This should be use when parsing a string representing a familiar image reference or identifier.
This parser would parse all qualified image reference the same as
parseQualifiedName
parser and parse every familiar image reference the
same as parseFamiliarName
pattaren | |
---|---|
reference | name [ ":" tag ] [ "@" digest ] |
name | [domain '/'] path-component ['/' path-component]* |
domain | domain-component ['.' domain-component]* [':' port-number] |
domain-component | `/([a-zA-Z0-9] |
port-number | /[0-9]+/ |
path-component | alpha-numeric [separator alpha-numeric]* |
alpha-numeric | /[a-z0-9]+/ |
separator | `/[_.] |
tag | /[\w][\w.-]{0,127}/ |
digest | digest-algorithm ":" digest-hex |
digest-algorithm | digest-algorithm-component [ digest-algorithm-separator digest-algorithm-component ]* |
digest-algorithm-separator | /[+.-_]/ |
digest-algorithm-component | /[A-Za-z][A-Za-z0-9]*/ |
digest-hex | /[0-9a-fA-F]{32,}/ (At least 128 bit digest value) |
identifier | /[a-f0-9]{64}/ |
short-identifier | /[a-f0-9]{6,64}/ |
FAQs
A node.js package to parse docker image reference
The npm package @swimlane/docker-reference receives a total of 2,472 weekly downloads. As such, @swimlane/docker-reference popularity was classified as popular.
We found that @swimlane/docker-reference demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 43 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Socket uncovers malicious Rust crates impersonating fast_log to steal Solana and Ethereum wallet keys from source code.
Research
A malicious package uses a QR code as steganography in an innovative technique.
Research
/Security News
Socket identified 80 fake candidates targeting engineering roles, including suspected North Korean operators, exposing the new reality of hiring as a security function.