Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
(从做到右 topic
依次为 alphabet
, number
, math
)
首先需要安装 GraphicsMagick.
brew install graphicsmagick
apt-get install graphicsmagick
同时请确保您的 nodejs 版本为 >= 4.0.0,0.x 版本都将于今年年底前停止支持,参考 Nodejs LTS 现状。
该方案的优势是简单,并且可以针对每张验证码单独使用配置。但是由于每张验证码都需要实时生成,所以无法满足秒杀等并发较高的场景。
npm install campto --save
代码示例:
const campto = require('campto')
campto(options).then(captcha => {
// captcha.buffer 为验证码图片的 buffer,express 中可以直接 res.send(buffer) 返回图片(png)
// captcha.result 为当前验证码的结果,建议放入 session 中,int10 类型。
})
这里的 options 为可选参数,和 campto.[json|js]
基本一致,例如 options
可以指定当前生成验证码的识别难度 [easy|normal|hard]
:
const campto = require('campto')
campto({
recognitionDifficulty: 'hard'
}).then(...)
使用参考 https://github.com/vincenting/campto/blob/master/examples/simple-server/server.js 。 更多参数请参考 campto.[json|js] 配置文件详细介绍
{
"captchaHeight": Int, 验证码高度,默认 50,
"captchaWidth": Int, 验证码宽度,默认 285,
"randColorSet": []String, 随机颜色集,用于文字和线条,默认 ['#000000', ...],
"backgroundSet": []String,随机背景图片路径集合,建议高度宽度与验证码一致,
"fontFileSet": []String,随机验证码字体文件路径集合,
"topic:: [String|Promise|Function],验证码内容选项,默认为 "math",可选 math|number|alphabet,同时支持直接传入自定义 topic,
"recognitionDifficulty": String, 验证码识别难度,默认为 "normal",可选 easy|normal|hard
}
topic
参数详细介绍:除了可以传入上述文档中涉及到 String
类型内容外,还可以传入 Promise
以及 Function
,用于自定义生成验证码内容,其中前者多用于有异步操作的情况。
如果是 Function
,最终需要返回 {subject: []String, result: Any}
,如果是 Promise
,最终也需要确保可以通过 .then
得到相同的数据结构,subject 中每个 String 为基本等宽的内容,例如可以认为一个汉字和两个阿拉伯数字等宽。
例如用于最终可以生成六个数字的验证码的代码:
{
topic: _ => {
const t = String(Math.random()).substr(2, 6)
return {
subject: t.split(''),
result: t
}
}
}
{
topic: _ => {
return Promise((resolve, reject) => {
// ... some async code
return resolve({
subject: t.split(''),
result: t
})
})
}
}
即将到来。
即将到来。
git clone git@github.com:vincenting/campto.git
npm install
npm test
npm run test-cov
进入 /examples/simple-server 运行 node server.js
启动测试服务器
lib/builder
中目前由于对 gm
熟悉度有限,通过临时文件拼接产生验证码的方式需要整体改进。FAQs
Best captcha package for nodejs.
The npm package campto receives a total of 4 weekly downloads. As such, campto popularity was classified as not popular.
We found that campto demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.