Security News
Supply Chain Attack Detected in @solana/web3.js Library
A supply chain attack has been detected in versions 1.95.6 and 1.95.7 of the popular @solana/web3.js library.
crx is a node.js command line app for packing Google Chrome extensions. If you'd like to integrate it into your grunt workflow, give oncletom's grunt-crx a spin.
$ npm install crx
This module exports the ChromeExtension
constructor directly, which can take an optional attribute object, which is used to extend the instance.
Loads the Chrome Extension from the specified path.
Packs the Chrome Extension, and calls back with a Buffer containing the .crx
file.
Returns a Buffer containing the update.xml file used for autoupdate, as specified for update_url
in the manifest. In this case, the instance must have a property called codebase
.
Destroys all of the temporary resources used for packing.
var fs = require("fs")
, ChromeExtension = require("crx")
, join = require("path").join
, crx = new ChromeExtension(
codebase: "http://localhost:8000/myFirstExtension.crx",
privateKey: fs.readFileSync(join(__dirname, "key.pem")),
rootDirectory: join(__dirname, "myFirstExtension")
})
crx.load(function(err) {
if (err) throw err
this.pack(function(err, data){
if (err) throw err
var updateXML = this.generateUpdateXML()
fs.writeFile(join(__dirname, "update.xml"), updateXML)
fs.writeFile(join(__dirname, "myFirstExtension.crx"), data)
this.destroy()
})
})
Pack the specified directory into a .crx package, and output it to stdout. If no directory is specified, the current working directory is used.
Use the -f
option to output to a file instead of stdout; if no file is specified, the package is given the same name as the directory basename.
Use the -p
option to specify an external private key. If this is not used, key.pem
is used from within the directory. If this option is not used and no key.pem
file exists, one will be generated automatically.
Use the -b
option to specify the maximum buffer allowed to generate extension. By default, will rely on node
internal setting (~200KB).
Generate a 1,024-bit RSA private key within the directory. This is called automatically if a key is not specified, and key.pem
does not exist.
Show information about using this utility, generated by commander.
Given the following directory structure:
└─┬ myFirstExtension
├── manifest.json
└── icon.png
run this:
cd myFirstExtension
crx pack -f
to generate this:
├─┬ myFirstExtension
│ ├── manifest.json
│ ├── icon.png
│ └── key.pem
└── myFirstExtension.crx
You can also name the output file like this:
cd myFirstExtension
crx pack -f myFirstExtension.crx
to get the same results, or also pipe to the file manually like this.
cd myFirstExtension
crx pack > ../myFirstExtension.crx
As you can see a key is generated for you at key.pem
if none exists. You can also specify an external key. So if you have this:
├─┬ myFirstExtension
│ ├── manifest.json
│ └── icon.png
└── myPrivateKey.pem
you can run this:
crx pack myFirstExtension -p myPrivateKey.pem -f
to sign your package without keeping the key in the directory.
Copyright (c) 2012 Jed Schmidt. See LICENSE.txt for details.
Send any questions or comments here.
FAQs
crx is a utility to package Google Chrome extensions via a Node API and the command line
We found that crx demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 4 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
A supply chain attack has been detected in versions 1.95.6 and 1.95.7 of the popular @solana/web3.js library.
Research
Security News
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
Security News
Research
Socket researchers have discovered malicious npm packages targeting crypto developers, stealing credentials and wallet data using spyware delivered through typosquats of popular cryptographic libraries.