Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
To install this, simply go to your project and run the following command:
npm install dolma@latest --save
This will show you how to encode and decode tokens
In this example, you will see multiple ways to encode your tokens. The first one is in plain text. You can pass any string into the encoder and it will convert it into an array of Message Tokens.
import { dolma } from 'dolma';
const str = "I'm @HoloPanio, and I'd like to goto `Paris, France` one day :catJAM: Also, https://google.com is epic!";
const tokens = dolma.encode(str);
console.log(tokens);
/**
Returns:
[
{ t: 'text', v: "I'm" },
{ t: 'mention', v: 'HoloPanio' },
{ t: 'text', v: ',' },
{ t: 'text', v: 'and' },
{ t: 'text', v: "I'd" },
{ t: 'text', v: 'like' },
{ t: 'text', v: 'to' },
{ t: 'text', v: 'goto' },
{ t: 'block', v: 'Paris, France' },
{ t: 'text', v: 'one' },
{ t: 'text', v: 'day' },
{ t: 'emote', v: 'catJAM' },
{ t: 'text', v: 'Also,' },
{ t: 'link', v: 'https://google.com' },
{ t: 'text', v: 'is' },
{ t: 'text', v: 'epic!' }
]
*/
In this example, you will see that you can have an mixed array with strings, and unitokens! A unitoken is a token object where you define your object key as the token type, and the value as the value of the token, doing so would look like such: {link: "https://google.com"}
, and this can be done for all token types.
import { dolma } from 'dolma';
const arr = ["I'm", {mention: "HoloPanio"},", and I'd like to goto", {block: "Paris, France"},"one day", {emote: "catJAM"}, "Also",{link: 'https://google.com'}, "is epic!"];
const tokens = dolma.encode(str);
console.log(tokens);
/**
Returns:
[
{ t: 'text', v: "I'm" },
{ t: 'mention', v: 'HoloPanio' },
{ t: 'text', v: ',' },
{ t: 'text', v: 'and' },
{ t: 'text', v: "I'd" },
{ t: 'text', v: 'like' },
{ t: 'text', v: 'to' },
{ t: 'text', v: 'goto' },
{ t: 'block', v: 'Paris, France' },
{ t: 'text', v: 'one' },
{ t: 'text', v: 'day' },
{ t: 'emote', v: 'catJAM' },
{ t: 'text', v: 'Also,' },
{ t: 'link', v: 'https://google.com' },
{ t: 'text', v: 'is' },
{ t: 'text', v: 'epic!' }
]
*/
You can also pass in message tokens like {t: 'link', v: 'https://google.com'}
, and it will work because the encoder checks for all possible methods that can be used.
When you get a payload from DogeHouse, you can use the decode method which will take the tokens, and turn it into a raw text string when you can use anywhere you please. The decode method will always encode the data sent to it to ensure that the data is parsed correctly, so that means you can also pass in un-encoded data, such as the array in the previous example, and will print out a plain text string. In this example, we will take the array from above, and return it to a plain text string using the decode method.
import { dolma } from 'dolma';
const tokens = [
{ t: 'text', v: "I'm" },
{ t: 'mention', v: 'HoloPanio' },
{ t: 'text', v: ',' },
{ t: 'text', v: 'and' },
{ t: 'text', v: "I'd" },
{ t: 'text', v: 'like' },
{ t: 'text', v: 'to' },
{ t: 'text', v: 'goto' },
{ t: 'block', v: 'Paris, France' },
{ t: 'text', v: 'one' },
{ t: 'text', v: 'day' },
{ t: 'emote', v: 'catJAM' },
{ t: 'text', v: 'Also,' },
{ t: 'link', v: 'https://google.com' },
{ t: 'text', v: 'is' },
{ t: 'text', v: 'epic!' }
];
const message = dolma.decode(tokens);
console.log(message);
/**
Returns:
I'm @HoloPanio , and I'd like to goto `Paris, France` one day :catJAM: Also, https://google.com is epic!
*/
FAQs
A token encoder and decoder for DogeHouse and associated projects
The npm package dolma receives a total of 0 weekly downloads. As such, dolma popularity was classified as not popular.
We found that dolma demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.