Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
The dns-txt npm package is used to encode and decode DNS TXT records. TXT records are often used to hold descriptive text and machine-readable data within DNS (Domain Name System). The dns-txt package provides a straightforward API for handling these records, making it easier to work with them in Node.js applications.
Encoding TXT records
This feature allows you to encode JavaScript objects into TXT record formats. The `encode` method takes an object and returns a buffer that represents the TXT record, which can be used in DNS settings.
const txt = require('dns-txt')();
const encoded = txt.encode({key: 'value'});
console.log(encoded); // Output will be a buffer representing the TXT record
Decoding TXT records
This feature enables the decoding of TXT records back into JavaScript objects. The `decode` method takes a buffer that represents the TXT record and returns an object with the data extracted from the record.
const txt = require('dns-txt')();
const decoded = txt.decode(Buffer.from('key=value'));
console.log(decoded); // Output will be an object { key: 'value' }
dns-packet is another npm package that allows encoding and decoding of DNS packets. It supports a broader range of DNS record types compared to dns-txt, which focuses only on TXT records. This makes dns-packet suitable for more comprehensive DNS operations.
native-dns-packet provides similar functionalities to dns-txt but with a focus on performance and lower-level control of DNS packet handling. It supports multiple DNS record types and offers more detailed control over packet creation and parsing.
Encode or decode the RDATA field in multicast DNS TXT records. For use with DNS-Based Service Discovery. For details see RFC 6763.
npm install dns-txt
var txt = require('dns-txt')()
var obj = {
foo: 1,
bar: 2
}
var enc = txt.encode(obj) // <Buffer 05 66 6f 6f 3d 31 05 62 61 72 3d 32>
txt.decode(enc) // { foo: '1', bar: '2' }
The encoder and decoder conforms to RFC 6763.
The module exposes a constructor function which can be called with an optional options object:
var txt = require('dns-txt')({ binary: true })
The options are:
binary
- If set to true
all values will be returned as Buffer
objects. The default behavior is to turn all values into strings. But
according to the RFC the values can be any binary data. If you expect
binary data, use this option.txt.encode(obj, [buffer], [offset])
Takes a key/value object and returns a buffer with the encoded TXT
record. If a buffer is passed as the second argument the object should
be encoded into that buffer. Otherwise a new buffer should be allocated
If an offset is passed as the third argument the object should be
encoded at that byte offset. The byte offset defaults to 0
.
This module does not actively validate the key/value pairs, but keep the following in rules in mind:
To be RFC compliant, each key should conform with the rules as specified in section 6.4.
To be RFC compliant, each value should conform with the rules as specified in section 6.5.
After encoding txt.encode.bytes
is set to the amount of bytes used to
encode the object.
txt.decode(buffer, [offset], [length])
Takes a buffer and returns a decoded key/value object. If an offset is
passed as the second argument the object should be decoded from that
byte offset. The byte offset defaults to 0
. Note that all keys will be
lowercased and all values will be Buffer objects.
After decoding txt.decode.bytes
is set to the amount of bytes used to
decode the object.
txt.encodingLength(obj)
Takes a single key/value object and returns the number of bytes that the given object would require if encoded.
MIT
FAQs
Encode/decode DNS-SD TXT record RDATA fields
The npm package dns-txt receives a total of 1,705,083 weekly downloads. As such, dns-txt popularity was classified as popular.
We found that dns-txt demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.