Research
Recent Trends in Malicious Packages Targeting Discord
The Socket research team breaks down a sampling of malicious packages that download and execute files, among other suspicious behaviors, targeting the popular Discord platform.
data-protector
Advanced tools
Readme
The data-protector allows one to log your objects safely. There are plenty of data obfuscators already. The issue, however, with them is that often you need to blacklist instead of whitelist. If an engineer added a key to the object, which happened to be the customer's entire billing profile, you would end up leaking PII and have an incident on your hands.
Another difference between this library and other similar libraries, it doesnt just mask, which often would render information useless, but it saves the types of data that it masked, for example:
Which I believe is what one would need to debug an issue that was caught outside of non-live environments.
Library also supports very primitive JSONPath like syntax for whitelisting specific namespace or a key.
npm install data-protector --save
import {DataProtector} from "data-protector";
const protectedObject = DataProtector.protect({
string: "string",
number: 123,
undefined: undefined,
empty: "",
boolean: true
});
/*
{
string: 'string(6).contains(lower)',
number: 'number.int(3).positive',
undefined: 'undefined',
empty: 'string(0).empty',
boolean: 'boolean'
}
*/
const protectedObject = DataProtector.protect({
string: "string",
number: 123,
array: [123, {
string: "someString",
string2: "someString2"
}],
array2: [123, {
string: "someString"
}],
undefined: undefined,
empty: "",
boolean: true
}, [{jsonPath: "$.array[0]"}, {jsonPath: "$.array[1].string2"}]);
/*
{
"string": "string(6).contains(lower)",
"number": "number.int(3).positive",
"array": [
123,
{
"string": "string(10).contains(upper,lower)",
"string2": "someString2"
}
],
"array2": [
"number.int(3).positive",
{
"string": "string(10).contains(upper,lower)"
}
],
"undefined": "undefined",
"empty": "string(0).empty",
"boolean": "boolean"
}
*/
const protectedObject = DataProtector.protect({
array: [123, {
string: "someString",
string2: "someString2"
}],
}, [
{
jsonPath: "$.array[0]",
masker: (valueToMask) => {
return "xxx";
}
}
]
);
/*
{
"array": [
"xxx",
{
"string": "string(10).contains(upper,lower)",
"string2": "string(11).contains(upper,lower,number)"
}
]
}
*/
DataProtector.protect(
valueToProtect: string | number | object | array | any, {
jsonPath: string,
masker?: (valueToProtect: string) => string
}[]
);
Clone the repository and change your current directory into a projects directory
git clone https://github.com/winfinit/data-protector.git
cd data-protector
Make sure typescript and mocha are installed
npm install typescript mocha --global
Build/rebuild the project
npm run clean-build
// or run: rm -Rf ./build && tsc
Ensure that tests are passing
npm test
// or run mocha --recursive ./built/test/
Same as Linux/OSX but change paths to match windows
FAQs
Masks javascript data constructs by replacing data with abstract yet descriptive values
We found that data-protector demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
The Socket research team breaks down a sampling of malicious packages that download and execute files, among other suspicious behaviors, targeting the popular Discord platform.
Security News
Socket CEO Feross Aboukhadijeh joins a16z partners to discuss how modern, sophisticated supply chain attacks require AI-driven defenses and explore the challenges and solutions in leveraging AI for threat detection early in the development life cycle.
Security News
NIST's new AI Risk Management Framework aims to enhance the security and reliability of generative AI systems and address the unique challenges of malicious AI exploits.