
Research
5 Malicious Chrome Extensions Enable Session Hijacking in Enterprise HR and ERP Systems
Five coordinated Chrome extensions enable session hijacking and block security controls across enterprise HR and ERP platforms.
Distributed notes/password manager
npm install autopass
[!NOTE] Autopass needs Corestore 7, our latest major version that is backed by RocksDB for storage and atomicity.
First choose if you wanna pair or make a new instance.
import Autopass from 'autopass'
import Corestore from 'corestore'
const pass = new Autopass(new Corestore('./pass'))
const inv = await pass.createInvite()
console.log('share to add', inv)
Then invite another instance
const pair = Autopass.pair(new Corestore('./another-pass'), inv)
const anotherPass = await pair.finished()
await anotherPass.ready()
When paired you can simply start the instance again with the normal constructor.
await pass.add('a-note', 'hello this is a note')
Then on the other node you get it out with
const note = await pass.get('a-note')
console.log({ note })
pass = new Autopass(new Corestore(path))Make a new pass instance.
pass.on('update', fn)Triggered when it updates, ie something added/removed an entry
value = await pass.get(key)Get an entry.
stream = pass.list()Get all entries.
await pass.add(key, value, file)Add new entry
await pass.remove(key)Remove an entry.
await pass.removeWriter(writerKey)Remove a writer explictly.
await pass.addWriter(writerKey)Add a writer explictly.
pass.writerKeyGet the local writer key.
inv = await pass.createInvite()Get invite to add a writer.
await deleteInvite()Delete the current invite.
await pass.ready()Wait for the pass to load fully
pair = Autopass.pair(new Corestore(path), invite)Pair with another instance.
pass = await pair.finished()Wait for the pair to finish.
await pass.addMirror(key)Add a blind mirror.
await getMirror()Returns an array of blind mirrors
await removeMirror(key)Remove a blind mirror
await pair.close()Force close the pair instance. Only need to call this if you dont wait for it to finish.get
await pass.close()Fully close the pass instance.
await pass.suspend()Suspend the swarm and discovery
await pass.resumeResume the swarm is suspended
Written with big contributions from @supersu
FAQs
Distributed notes/password manager
We found that autopass demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Five coordinated Chrome extensions enable session hijacking and block security controls across enterprise HR and ERP platforms.

Research
Node.js patched a crash bug where AsyncLocalStorage could cause stack overflows to bypass error handlers and terminate production servers.

Research
/Security News
A malicious Chrome extension steals newly created MEXC API keys, exfiltrates them to Telegram, and enables full account takeover with trading and withdrawal rights.