Research
Security News
Malicious npm Package Targets Solana Developers and Hijacks Funds
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
`DataIntegrityTree` is a TypeScript class designed to efficiently organize and manage any arbitrary file data using a Merkle tree. A Merkle tree is a cryptographic data structure that allows for secure and efficient verification of data integrity. By orga
DataIntegrityTree
is a TypeScript class designed to efficiently organize and manage any arbitrary file data using a Merkle tree. A Merkle tree is a cryptographic data structure that allows for secure and efficient verification of data integrity. By organizing files into a Merkle tree, DataIntegrityTree
enables you to verify that a specific piece of data belongs to a dataset and ensures that the data has not been altered.
This class provides methods to store, retrieve, and verify data, making it particularly useful in scenarios where data integrity is critical, such as distributed systems, blockchain, or secure file storage.
The storeId is a 64-character hexadecimal string that uniquely represents a data store within DataIntegrityTree. This ID is crucial as it ensures that each data store is distinct and isolated. While the storeId can be generated from any source, it is important to ensure that storeIds are generated in a manner that guarantees their uniqueness. This can typically be achieved using cryptographic hash functions or UUIDs. The uniqueness of storeIds is vital to prevent data collisions and ensure that each data store maintains its integrity independently.
The DataIntegrityTree
class organizes files in a hierarchical directory structure to efficiently manage a large number of files. This approach enhances performance and scalability, especially when dealing with millions of files.
Local Mode: In local mode, the data directory is specific to each store. Data is stored inside the storeDir/storeId/data
directory, which is structured using the first few characters of each file’s SHA-256 hash. This creates multiple levels of directories to prevent overloading any single directory.
Unified Mode: In unified mode, the data directory is shared across all stores, residing in the storeDir/data
directory. Files are still organized using their SHA-256 hash to ensure efficient storage and retrieval.
The manifest file (manifest.dat
) stores the history of Merkle tree root hashes. It is located directly under the store's directory. Each line in the manifest file corresponds to a different state of the Merkle tree.
Serialized Merkle trees are stored as .dat
files named after their root hash. This allows the DataIntegrityTree
to load the state of the Merkle tree at any given point in time.
Binary files are stored in a directory structure that reflects the first few characters of their SHA-256 hash, with each level of the directory corresponding to two characters from the hash. This structure efficiently distributes files across the filesystem, enhancing performance when dealing with large datasets.
import { DataIntegrityTree } from './DataIntegrityTree';
const storeId = 'a'.repeat(64); // A 64-character hexadecimal string
const dataLayer = new DataIntegrityTree(storeId, { storageMode: 'local' });
Store a binary stream in the Merkle tree:
import { Readable } from 'stream';
const data = "This is some test data";
const readStream = Readable.from([data]);
dataLayer.upsertKey(readStream, 'test_key')
.then(() => console.log('Key upserted successfully'))
.catch(err => console.error('Error upserting key:', err));
Verify the integrity of a stored file:
const sha256 = crypto.createHash("sha256").update(data).digest("hex");
const rootHash = dataLayer.getRoot();
dataLayer.verifyKeyIntegrity(sha256, rootHash)
.then(isValid => {
if (isValid) {
console.log('File integrity verified.');
} else {
console.log('File integrity verification failed.');
}
})
.catch(err => console.error('Error verifying key integrity:', err));
Retrieve and decompress a stored file:
const hexKey = Buffer.from('test_key').toString('hex');
const fileStream = dataLayer.getValueStream(hexKey);
fileStream.on('data', chunk => {
console.log('Received chunk:', chunk.toString());
});
fileStream.on('end', () => {
console.log('File streaming completed.');
});
Commit the current state of the Merkle tree:
const rootHash = dataLayer.commit();
console.log('Committed Merkle tree with root hash:', rootHash);
Generate a proof for a file and verify it:
const proof = dataLayer.getProof(hexKey, sha256);
const isValid = dataLayer.verifyProof(proof, sha256);
if (isValid) {
console.log('Proof verified successfully.');
} else {
console.log('Proof verification failed.');
}
Delete a key or all keys in the Merkle tree:
dataLayer.deleteKey('test_key');
console.log('Key deleted.');
dataLayer.deleteAllLeaves();
console.log('All leaves deleted from the Merkle tree.');
Compare two Merkle tree roots:
const diff = dataLayer.getRootDiff(rootHash1, rootHash2);
console.log('Added keys:', Array.from(diff.added.keys()));
console.log('Deleted keys:', Array.from(diff.deleted.keys()));
DataIntegrityTree
instance.This project is licensed under the MIT License.
FAQs
The DIG Network offers a robust solution for ensuring data integrity and censorship resistance by leveraging decentralized technology. When you add your data to DIG, it is encoded and served from a Merkle tree, with the Merkle root securely stored on the
The npm package dig-cli receives a total of 0 weekly downloads. As such, dig-cli popularity was classified as not popular.
We found that dig-cli demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
Security News
Research
Socket researchers have discovered malicious npm packages targeting crypto developers, stealing credentials and wallet data using spyware delivered through typosquats of popular cryptographic libraries.
Security News
Socket's package search now displays weekly downloads for npm packages, helping developers quickly assess popularity and make more informed decisions.