
Research
Malicious fezbox npm Package Steals Browser Passwords from Cookies via Innovative QR Code Steganographic Technique
A malicious package uses a QR code as steganography in an innovative technique.
Streaming environment variable reader
Accepts simple key=value data and passes it on after performing some basic filtering out of things like blank lines, comment lines and invalid env lines. Now also handles removing the 'export' keyword from the start of env var lines
Require the module
var env = require('env-reader')()
Listening for data events
env.on('data', function (envLine) {
//do something
})
Writing data
env.write('\n#comment line\ninvalid line\nvalid=line\n \n')
//only valid=line would be passed emitted, the rest would be disguarded
This module was built with the following type of input in mind:
#ENV config file
#environment definition
ENV=development
#database definition
DB_HOST=localhost
DB_USER=user
DB_PASS=password
DB_NAME=development
export EXPORTED_VAR=true
and will emit the following lines from such a file one after another:
ENV=development
DB_HOST=localhost
DB_USER=user
DB_PASS=password
DB_NAME=development
EXPORTED_VAR=true
if streamed the data in the following way:
fs.createReadStream('example.file').pipe(env)
If you were to send it all the data at once like:
var envFileString = "#ENV config file\n#environment definition\nENV=development\n\n" +
"#database definition\nDB_HOST=localhost\nDB_USER=user\nDB_PASS=password\n" +
"DB_NAME=development"
env.write(envFileString)
it would still break the string apart and emit the cleaned up env pieces 1 after another
FAQs
Streaming environment variable reader
We found that env-reader demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
A malicious package uses a QR code as steganography in an innovative technique.
Research
/Security News
Socket identified 80 fake candidates targeting engineering roles, including suspected North Korean operators, exposing the new reality of hiring as a security function.
Application Security
/Research
/Security News
Socket detected multiple compromised CrowdStrike npm packages, continuing the "Shai-Hulud" supply chain attack that has now impacted nearly 500 packages.