Security News
The Risks of Misguided Research in Supply Chain Security
Snyk's use of malicious npm packages for research raises ethical concerns, highlighting risks in public deployment, data exfiltration, and unauthorized testing.
The etag npm package is used to generate HTTP ETags, which are typically used for cache validation. It can generate ETags based on the contents of a file or a buffer, a string, or based on a specified entity and its attributes.
Generating ETags from a file
This code sample demonstrates how to generate an ETag for the contents of a file. It reads the file 'example.txt' and uses the etag function to create an ETag based on the file's contents.
const etag = require('etag');
const fs = require('fs');
fs.readFile('example.txt', function(err, data) {
if (err) throw err;
const eTagValue = etag(data);
console.log(eTagValue);
});
Generating ETags from a string
This code sample shows how to generate an ETag from a string. The etag function is called with a string 'Hello, World!' to produce an ETag for that specific string.
const etag = require('etag');
const entity = 'Hello, World!';
const eTagValue = etag(entity);
console.log(eTagValue);
Generating ETags with options
This example illustrates how to generate a weak ETag by passing an options object to the etag function. The options object specifies that the ETag should be weak, which is indicated by a 'W/' prefix in the ETag value.
const etag = require('etag');
const entity = Buffer.from('Hello, World!');
const options = { weak: true };
const eTagValue = etag(entity, options);
console.log(eTagValue);
The 'fresh' package is used to check if the HTTP response is still 'fresh' on the client side. It is similar to etag in that it deals with HTTP caching mechanisms, but it focuses on cache validation rather than ETag generation.
The 'cacheable-response' package is a higher-level abstraction for creating cacheable responses in Node.js servers. It uses ETags among other headers to manage caching. It provides a more comprehensive solution compared to etag, which is focused solely on ETag generation.
Create simple HTTP ETags
This module generates HTTP ETags (as defined in RFC 7232) for use in HTTP responses.
This is a Node.js module available through the
npm registry. Installation is done using the
npm install
command:
$ npm install etag
var etag = require('etag')
Generate a strong ETag for the given entity. This should be the complete
body of the entity. Strings, Buffer
s, and fs.Stats
are accepted. By
default, a strong ETag is generated except for fs.Stats
, which will
generate a weak ETag (this can be overwritten by options.weak
).
res.setHeader('ETag', etag(body))
etag
accepts these properties in the options object.
Specifies if the generated ETag will include the weak validator mark (that
is, the leading W/
). The actual entity tag is the same. The default value
is false
, unless the entity
is fs.Stats
, in which case it is true
.
$ npm test
$ npm run-script bench
> etag@1.8.1 bench nodejs-etag
> node benchmark/index.js
http_parser@2.7.0
node@6.11.1
v8@5.1.281.103
uv@1.11.0
zlib@1.2.11
ares@1.10.1-DEV
icu@58.2
modules@48
openssl@1.0.2k
> node benchmark/body0-100b.js
100B body
4 tests completed.
buffer - strong x 258,647 ops/sec ±1.07% (180 runs sampled)
buffer - weak x 263,812 ops/sec ±0.61% (184 runs sampled)
string - strong x 259,955 ops/sec ±1.19% (185 runs sampled)
string - weak x 264,356 ops/sec ±1.09% (184 runs sampled)
> node benchmark/body1-1kb.js
1KB body
4 tests completed.
buffer - strong x 189,018 ops/sec ±1.12% (182 runs sampled)
buffer - weak x 190,586 ops/sec ±0.81% (186 runs sampled)
string - strong x 144,272 ops/sec ±0.96% (188 runs sampled)
string - weak x 145,380 ops/sec ±1.43% (187 runs sampled)
> node benchmark/body2-5kb.js
5KB body
4 tests completed.
buffer - strong x 92,435 ops/sec ±0.42% (188 runs sampled)
buffer - weak x 92,373 ops/sec ±0.58% (189 runs sampled)
string - strong x 48,850 ops/sec ±0.56% (186 runs sampled)
string - weak x 49,380 ops/sec ±0.56% (190 runs sampled)
> node benchmark/body3-10kb.js
10KB body
4 tests completed.
buffer - strong x 55,989 ops/sec ±0.93% (188 runs sampled)
buffer - weak x 56,148 ops/sec ±0.55% (190 runs sampled)
string - strong x 27,345 ops/sec ±0.43% (188 runs sampled)
string - weak x 27,496 ops/sec ±0.45% (190 runs sampled)
> node benchmark/body4-100kb.js
100KB body
4 tests completed.
buffer - strong x 7,083 ops/sec ±0.22% (190 runs sampled)
buffer - weak x 7,115 ops/sec ±0.26% (191 runs sampled)
string - strong x 3,068 ops/sec ±0.34% (190 runs sampled)
string - weak x 3,096 ops/sec ±0.35% (190 runs sampled)
> node benchmark/stats.js
stat
4 tests completed.
real - strong x 871,642 ops/sec ±0.34% (189 runs sampled)
real - weak x 867,613 ops/sec ±0.39% (190 runs sampled)
fake - strong x 401,051 ops/sec ±0.40% (189 runs sampled)
fake - weak x 400,100 ops/sec ±0.47% (188 runs sampled)
FAQs
Create simple HTTP ETags
The npm package etag receives a total of 16,783,844 weekly downloads. As such, etag popularity was classified as popular.
We found that etag demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Snyk's use of malicious npm packages for research raises ethical concerns, highlighting risks in public deployment, data exfiltration, and unauthorized testing.
Research
Security News
Socket researchers found several malicious npm packages typosquatting Chalk and Chokidar, targeting Node.js developers with kill switches and data theft.
Security News
pnpm 10 blocks lifecycle scripts by default to improve security, addressing supply chain attack risks but sparking debate over compatibility and workflow changes.