Research
Security News
Quasar RAT Disguised as an npm Package for Detecting Vulnerabilities in Ethereum Smart Contracts
Socket researchers uncover a malicious npm package posing as a tool for detecting vulnerabilities in Etherium smart contracts.
🔐 Install, check and delete trusted root certificates.
npm install cert-store
Using path to .crt
, .cert
, or .pem
file.
import certstore from 'cert-store'
var certPath = './testsrv.root-ca.crt'
// installing certificate
await certstore.install(certPath)
// checking if cert is already installed
console.log('installed', await certstore.isInstalled(certPath))
// deleting certificate
await certstore.delete(certPath)
Using pem string.
import certstore from 'cert-store'
var pem = `
-----BEGIN CERTIFICATE-----
MIIB8TCCAVqgAwIBAgIJF7pYoC10fT2eMA0GCSqGSIb3DQEBCwUAMCsxKTAnBgNV
...
ZlMu5/XGsj/RuQx8iwEMHokKvEkW
-----END CERTIFICATE-----
`
// Install certificate from pem string.
await certstore.install(pem)
// Check for existence or delete (uses certificate's serial number).
var installed = await certstore.isInstalled(pem)
await certstore.delete(pem)
Using node-forge object.
import forge from 'node-forge'
import certstore from 'cert-store'
// Create your cert with node-forge.
// WARNING: this is incomplete example, look at node-forge's readme for more info.
var keys = pki.rsa.generateKeyPair(2048)
var cert = pki.createCertificate()
cert.publicKey = keys.publicKey
// certificate has to have UNIQUE serialNumber.
cert.serialNumber = '0123456789'
cert.validity.notBefore = new Date()
cert.validity.notAfter = new Date()
cert.validity.notAfter.setFullYear(cert.validity.notBefore.getFullYear() + 1)
cert.setSubject(...)
cert.setIssuer(...)
...
cert.sign(keys.privateKey)
// use the cert object as argument.
await certstore.install(cert)
This project was developed and tested on Windows and WSL Ubuntu. Mac is yet to be tested. If you're a mac user please submit issues, feedback and PRs.
MIT, Mike Kovařík, Mutiny.cz
FAQs
🔐 Install, check and delete trusted root certificates.
The npm package cert-store receives a total of 3 weekly downloads. As such, cert-store popularity was classified as not popular.
We found that cert-store demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket researchers uncover a malicious npm package posing as a tool for detecting vulnerabilities in Etherium smart contracts.
Security News
Research
A supply chain attack on Rspack's npm packages injected cryptomining malware, potentially impacting thousands of developers.
Research
Security News
Socket researchers discovered a malware campaign on npm delivering the Skuld infostealer via typosquatted packages, exposing sensitive data.