Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
cp3-kaitai-zlib
Advanced tools
zlib
processors for Kaitai Struct, with support for streams of unknown size.
# npm
npm install cp3-kaitai-zlib
# or yarn
yarn add cp3-kaitai-zlib
# ./mydata.ksy
meta:
id: my-data
# ...etc, etc...
seq:
- id: example_data
size: 0
process: cp3.kaitai.zlib.inflate(_io)
Decompresses the data. This will automatically detect gzip and zlib data (but not raw deflate data).
seq:
- id: glib_or_zlib_data_with_known_size
size: 80
process: cp3.kaitai.zlib.inflate
Decompresses the data using the specified windowBits
.
windowBits
0
To use the windowBits from the zlib header.8
and 15
for zlib.-8
and -15
for raw deflate.24
and 31
for gzip.40
and 47
to auto-detect zlib and gzip.seq:
- id: raw_data_with_known_size
size: 80
process: cp3.kaitai.zlib.inflate(-15)
Decompresses the stream until the stream ends or the end of the compressed data is reached. This will automatically detect gzip and zlib data (but not raw deflate data).
stream
- The kaitai stream to read from.seq:
- id: glib_or_zlib_data_with_unknown_size
size: 0
process: cp3.kaitai.zlib.inflate(_io)
Decompresses the stream using the specified windowBits
until the stream ends or the end of the compressed data is reached.
stream
- The kaitai stream to read from.windowBits
0
To use the windowBits from the zlib header.8
and 15
for zlib.-8
and -15
for raw deflate.24
and 31
for gzip.40
and 47
to auto-detect zlib and gzip.seq:
- id: glib_data_with_unknown_size
size: 0
process: cp3.kaitai.zlib.inflate(_io, 31)
Decompresses raw deflate data.
seq:
- id: raw_data_with_known_size
size: 80
process: cp3.kaitai.zlib.inflate_raw
Decompresses raw deflate data with the given windowBits
. Note: this will automatically adjust windowBits
for raw deflate decompression.
windowBits
- A number between 8
and 15
. See Notes on windowBits.seq:
- id: raw_data_with_known_size
size: 80
process: cp3.kaitai.zlib.inflate(15)
Decompresses zlib data.
seq:
- id: zlib_data_with_known_size
size: 80
process: cp3.kaitai.zlib.inflate_zlib
Decompresses the zlib stream until the stream ends or the end of the compressed data is reached.
stream
- The kaitai stream to read from.seq:
- id: zlib_data_with_unknown_size
size: 0
process: cp3.kaitai.zlib.inflate_zlib(_io)
Decompresses zlib data using the specified windowBits
. Note: this will automatically adjust windowBits
for zlib decompression.
windowBits
- A number between 8
and 15
. See Notes on windowBits.seq:
- id: zlib_data_with_known_size
size: 80
process: cp3.kaitai.zlib.inflate_zlib(15)
Decompresses the zlib stream using the specified windowBits
until the stream ends or the end of the compressed data is reached. Note: this will automatically adjust windowBits
for zlib decompression.
stream
- The kaitai stream to read from.windowBits
- A number between 8
and 15
. See Notes on windowBits.seq:
- id: zlib_data_with_unnown_size
size: 0
process: cp3.kaitai.zlib.inflate_zlib(_io, 15)
Decompresses gzip data.
seq:
- id: gzip_data_with_known_size
size: 80
process: cp3.kaitai.zlib.inflate_gzip
Decompresses the gzip stream until the stream ends or the end of the compressed data is reached.
stream
- The kaitai stream to read from.seq:
- id: gzip_data_with_unknown_size
size: 0
process: cp3.kaitai.zlib.inflate_gzip(_io)
Decompresses gzip data using the specified windowBits
. Note: this will automatically adjust windowBits
for gzip decompression.
windowBits
- A number between 8
and 15
. See Notes on windowBits.seq:
- id: gzip_data_with_known_size
size: 80
process: cp3.kaitai.gzip.inflate_gzip(15)
Decompresses the gzip stream using the specified windowBits
until the stream ends or the end of the compressed data is reached. Note: this will automatically adjust windowBits
for gzip decompression.
stream
- The kaitai stream to read from.windowBits
- A number between 8
and 15
. See Notes on windowBits.seq:
- id: gzip_data_with_unnown_size
size: 0
process: cp3.kaitai.zlib.inflate_gzip(_io, 15)
The windowBits
parameter in zlib is a bit confusing, here's what I know:
windowBits
parameter is the base two logarithm of the window size (the size of the history buffer).windowBits
is a number in the range 8..15windowBits
can be adjusted to change the data format:
windowBits
to 0 will use the window size from the zlib header.windowBits
will compress/decompress data as raw deflate data (data with no header or trailer).windowBits
will compress/decompress data in gzip format (deflate data wrapped in a gzip header/trailer)windowBits
will automatically detect gzip or zlib format when decompressing dataYou can also check the zlib
manual: https://www.zlib.net/manual.html#Advanced
This project is licensed under the MIT License - see the LICENSE.md file for details.
FAQs
Zlib processors for Kaitai Struct.
We found that cp3-kaitai-zlib demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.