
Research
Two Malicious Rust Crates Impersonate Popular Logger to Steal Wallet Keys
Socket uncovers malicious Rust crates impersonating fast_log to steal Solana and Ethereum wallet keys from source code.
Enable require('./path/to/any-node-project.asar') & require('./path/to/any-node-project.asar/any/file'). Or just run asar-node ./path/to/any-node-project.asar
Enable require('./path/to/any-node-project.asar')
& require('./path/to/any-node-project.asar/any/file')
in your nodejs app.
$ npm install -g asar-node
Exists ./path/to/any-node-project.asar
$ asar-node ./path/to/any-node-project # OK!
$ asar-node ./path/to/any-node-project.asar # OK!
$ asar-node ./path/to/any-node-project.asar/any/file # OK!
$ asar-node ./path/to/any-node-project.asar/any/file.js # OK!
$ asar-node ./path/to/any-node-project.asar/any/file.json # OK!
$ asar-node ./path/to/any-node-project.asar/any/file.node # OK!
Or
require('asar-node').register()
// Equivalent to require('asar-node/lib/register.js').register()
require('./path/to/any-node-project') // like require a nodejs directory
// or require('./path/to/any-node-project.asar')
require('./path/to/any-node-project.asar/any/file')
If require a asar file, make sure there is package.json
and main
field or index.js
/ index.json
/ index.node
in the asar root.
You can also pack node_modules
into node_modules.asar
instead of packing the hole project folder into an asar file.
To let node find modules from node_modules.asar
, You should
const { register, addAsarToLookupPaths } = require('asar-node')
// Equivalent to
// const register = require('asar-node/lib/register.js').register
// const addAsarToLookupPaths = require('asar-node/lib/lookup.js').addAsarToLookupPaths
register()
addAsarToLookupPaths()
const Koa = require('koa') // koa is in node_modules.asar
In an electron project, it's unnecessary to call register()
but you can also call addAsarToLookupPaths()
to enable node_modules.asar
support.
v1.x
require('asar-node')
v2.x
require('asar-node/lib/autorun/index')
Only these fs api functions are available in asar file and you should use absolute path. Also child_process
api is not supported in asar file.
If your nodejs project use C++ native addons, please unpack it from asar file by specifying --unpack=*.node
to asar CLI
Express or Koa serving static file in asar file is not supported, but you can unpack the static file folder.
FAQs
Enable require('./path/to/any-node-project.asar') & require('./path/to/any-node-project.asar/any/file'). Or just run asar-node ./path/to/any-node-project.asar
The npm package asar-node receives a total of 19 weekly downloads. As such, asar-node popularity was classified as not popular.
We found that asar-node demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Socket uncovers malicious Rust crates impersonating fast_log to steal Solana and Ethereum wallet keys from source code.
Research
A malicious package uses a QR code as steganography in an innovative technique.
Research
/Security News
Socket identified 80 fake candidates targeting engineering roles, including suspected North Korean operators, exposing the new reality of hiring as a security function.