Research
Security News
Threat Actor Exposes Playbook for Exploiting npm to Build Blockchain-Powered Botnets
A threat actor's playbook for exploiting the npm ecosystem was exposed on the dark web, detailing how to build a blockchain-powered botnet.
electron-machine-id
Advanced tools
Unique machine (desktop) id for Electron application (no admin privileges required).
Module based on OS native UUID/GUID which used for internal needs.
All others approaches requires elevated rights or much depends on hardware components, but this approach summarize the methods of selecting the most reliable unique identifier
MachineGuid
in registry
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography
(can be changed by administrator but with unpredictable consequences)It is generated during OS installation and won't change unless you make another OS updates or reinstall. Depending on the OS version it may contain the network adapter MAC address embedded (plus some other numbers, including random), or a pseudorandom number.
IOPlatformUUID
(the same Hardware UUID)
ioreg -rd1 -c IOPlatformExpertDevice
Value from I/O Kit registry in IOPlatformExpertDevice class
/var/lib/dbus/machine-id
(can be changed by root
but with unpredictable consequences)
http://man7.org/linux/man-pages/man5/machine-id.5.htmlThe /var/lib/dbus/machine-id file contains the unique machine ID of the local system that is set during installation. The machine ID is a single newline-terminated, hexadecimal, 32-character, lowercase machine ID string. When decoded from hexadecimal, this corresponds with a 16-byte/128-bit string.
The machine ID is usually generated from a random source during system installation and stays constant for all subsequent boots. Optionally, for stateless systems, it is generated during runtime at early boot if it is found to be empty.
The machine ID does not change based on user configuration or when hardware is replaced.
npm install electron-machine-id
<Boolean>
, If true
return original value of machine id, otherwise return hashed value (sha-256), default: false
machineId
import {machineId, machineIdSync} from 'electron-machine-id';
// Asyncronous call with async/await or Promise
async function getMachineId() {
let id = await machineId();
...
}
machineId().then((id) => {
...
})
// Syncronous call
let id = machineIdSync()
// id = c24b0fe51856497eebb6a2bfcd120247aac0d6334d670bb92e09a00ce8169365
let id = machineIdSync({original: true})
// id = 98912984-c4e9-5ceb-8000-03882a0485e4
FAQs
This package is no longer supported and has been deprecated. To avoid malicious use, npm is hanging on to the package name.
The npm package electron-machine-id receives a total of 2 weekly downloads. As such, electron-machine-id popularity was classified as not popular.
We found that electron-machine-id demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A threat actor's playbook for exploiting the npm ecosystem was exposed on the dark web, detailing how to build a blockchain-powered botnet.
Security News
NVD’s backlog surpasses 20,000 CVEs as analysis slows and NIST announces new system updates to address ongoing delays.
Security News
Research
A malicious npm package disguised as a WhatsApp client is exploiting authentication flows with a remote kill switch to exfiltrate data and destroy files.