Research
Security News
Quasar RAT Disguised as an npm Package for Detecting Vulnerabilities in Ethereum Smart Contracts
Socket researchers uncover a malicious npm package posing as a tool for detecting vulnerabilities in Etherium smart contracts.
archiviation
Advanced tools
A way to publish text with GitHub Pages without allowing everyone to read.
A way to publish text with GitHub Pages without allowing everyone to read.
Note: This software does not have a stable version yet.
Archiviation encrypts your text files with AES. The AES key is derived from the master key and the filename. The master key is automatically generated during initialization.
A file can be accessed online with a URL like https://username.github.io/?key=${__AES_KEY__}&file=${__FILE_NAME__}
, after you push the repository to GitHub Pages (or any other web server). The identifier consists of the 64-character-long AES encryption key and the filename hash. The page will load the file with XMLHttpRequest from https://username.github.io/db/${__FILE_NAME__}
. So you do not have to worry about the sensitivity of file names; the URL itself cannot be used to infer the filename.
__AES_KEY__
is generated by:
var key = crypto.createHash('sha256').update(config.masterKey + 'd46fb93ff24448b4a04ee3115cf5147d|9cfbf34fc443455baf19c27f692ecc76|' + articleFileName_raw).digest('base64').replace(/[\=\+\/]/g, '').slice(0, 22);
return key;
__FILE_NAME__
is generated by:
var masterSalt = crypto.createHash('sha256').update(config.masterKey.slice(0, 32)).digest('base64');
var filename = crypto.createHash('sha256').update('d46fb93ff24448b4a04ee3115cf5147d|9cfbf34fc443455baf19c27f692ecc77|' + masterSalt + articleFileName_raw).digest('base64').replace(/[\=\+\/]/g, '').slice(0, 28);
filename += '_' + crypto.createHash('sha256').update('48b4a04ee3115c' + masterSalt.slice(0,5) + articleFileName_raw).digest('base64').replace(/[\=\+\/]/g, '').slice(4, 8);
return filename;
This approach should probably be cryptographically strong enough. Probably!
node
npm
Install through NPM:
$ npm install -g archiviation
If NPM is not available:
$ git clone https://github.com/neruthes/archiviation.git
$ cd archiviation
$ npm install .
$ npm link
Get inside a directory which you would like to store your project.
$ archiviation init
$ archiviation build
$ cat docs-index.txt
All information you are able to configure is in /archiviation-config.json
.
You may add plaintext files in /source-articles
.
You are supposed to git init
in /html
. And publish to any web server, like GitHub Pages.
Create a link to a file. Otherwise, if you add a link in Markdown grammar to a file in the archive, you will need to manually update the link whenever you modify the master key. Modifying the master key will make all previously generated links invalid.
{{LINKTO|File_Name.txt}}
© 2018-2020 Neruthes (a.k.a. J.N.)
License: AGPL.
FAQs
A way to publish text with GitHub Pages without allowing everyone to read.
We found that archiviation demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket researchers uncover a malicious npm package posing as a tool for detecting vulnerabilities in Etherium smart contracts.
Security News
Research
A supply chain attack on Rspack's npm packages injected cryptomining malware, potentially impacting thousands of developers.
Research
Security News
Socket researchers discovered a malware campaign on npm delivering the Skuld infostealer via typosquatted packages, exposing sensitive data.