Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Make your own Google Fonts API with some extra features
http://localhost:3000/types?name=serif&orderBy=popularity&dir=desc
http://localhost:3000/search?name=roboto
http://localhost:3000/search?orderBy=family&dir=asc
git clone https://github.com/ClickSimply/buzzfont.git
cd buzzfeed && npm i
Open the sample-server.js
file and upate the details at the top.
const PORT = 3000;
const PUBLIC_URL = `http://localhost:${PORT}`;
const APIKEY = "YOUR GOOGLE KEY HERE";
node sample-server.js
The script will generate preview URLs for every font available (over 800), then will start the express server. The example queries above will work from here.
The library itself doesn't have any expressJS or other server code. It just handles the indexing of the fonts and other cool stuff.
You can easily embed the library in your own project. The "sample-server.js" file shows a full working example of the script working with express, a smaller example is below.
npm i buzzfont --save
const BuzzFont = require("buzzfont").BuzzFont;
const express = require("express");
const http = require("http");
const PORT = 3000;
const PUBLIC_URL = `http://localhost:${PORT}`;
const APIKEY = "YOUR GOOGLE KEY HERE";
const fontDB = new BuzzFont({
apiKey: APIKEY,
baseURL: PUBLIC_URL,
ready: () => {
const app = express();
// Serve the preview images
app.use("/previews", express.static("./previews"));
// Once initilized, the library exposes fontDB.nSQL() as a nanoSQL store containing the fonts
// Read about how to use nanosql here https://github.com/ClickSimply/Nano-SQL/wiki/2.-Query
// Handle queries with nanosql
app.get("/search", (req, res) => {
fontDB.nSQL()
.query("select")
.where(["family", "LIKE", req.query.name])
.exec().then((rows) => {
res.send(rows).end();
});
});
// Run Server
http.createServer(app).listen(PORT, () => {
console.log("Server listening on %d", PORT);
});
}
});
FAQs
Your Own Powerful Google Fonts API
The npm package buzzfont receives a total of 2 weekly downloads. As such, buzzfont popularity was classified as not popular.
We found that buzzfont demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.