
Research
Malicious fezbox npm Package Steals Browser Passwords from Cookies via Innovative QR Code Steganographic Technique
A malicious package uses a QR code as steganography in an innovative technique.
Immutable data can make things fast. The problem is trying to model your data as immutable is very challenging. You might have seen libraries like Immutable.js and seamless-immutable and feared switching.
EvilDiff comes to the rescue!
It will compare two pieces of data, apply any changes it finds, and clone along the path. Unchanged data keep their old pointer and changed data gets new pointers along its path.
Install evil-diff using npm or yarn.
npm install evil-diff
Then require it into any module.
import EvilDiff from 'evil-diff';
var objDiff = EvilDiff.revise(obj1, obj2);
No changes between two objects returns original object:
const result1 = { 'John': {name: {first: 'John', last: 'Doe'}, zipCode: '86469'} };
const result2 = { 'John': {name: {first: 'John', last: 'Doe'}, zipCode: '86469'} };
assertFalse(result1 === result2); // not same object
assertdeepEqual(result1, result2); // but same data
const revisedResult = EvilDiff.revise(result1, result2);
assertTrue(revisedResult === result1); //Data was unchanged, returns old pointer
Changes return new references, but preserve references for unchanged properties
const result1 = { 'John': {name: {first: 'John', last: 'Doe'}, zipCode: '86469'} };
const result2 = { 'John': {name: {first: 'John', last: 'Doe'}, zipCode: '91752'} };
assertFalse(result1 === result3); // not same object
assertNotDeepEqual(result1, result3); // different data
const revisedResult = EvilDiff.revise(result1, result3);
assertFalse(revisedResult === result1 || revisedResult === result3); //Data was changed, new object
assertDeepEqual(revisedResult, result3); // Data matches result3
assertTrue(revisedResult.John.name === result1.John.name); // Unchanged data keeps same reference
FAQs
evil-diff
We found that evil-diff demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
A malicious package uses a QR code as steganography in an innovative technique.
Research
/Security News
Socket identified 80 fake candidates targeting engineering roles, including suspected North Korean operators, exposing the new reality of hiring as a security function.
Application Security
/Research
/Security News
Socket detected multiple compromised CrowdStrike npm packages, continuing the "Shai-Hulud" supply chain attack that has now impacted nearly 500 packages.