
Research
Malicious npm Packages Impersonate Flashbots SDKs, Targeting Ethereum Wallet Credentials
Four npm packages disguised as cryptographic tools steal developer credentials and send them to attacker-controlled Telegram infrastructure.
A faster implementation of Electron's ASAR archive format.
This is both a library and a CLI tool.
You can install fast-asar
from NPM (or your preferred package manager):
npm install fast-asar
You can use the CLI tool to extract and create ASAR archives.
npx fast-asar help
The library exports an Asar
class, which can be used to read and write ASAR archives.
For example, to extract an ASAR archive to a directory:
import { Asar } from "fast-asar";
import { readFile } from "fs/promises";
const asarBytes = await readFile("./app.asar");
const asar = new Asar(asarBytes);
await asar.extract("./app-extracted");
For more information, see the API documentation.
This library can be run with Node.js and Bun.
Browser support is planned.
The following benchmarks were run with hyperfine on a 2016 MacBook Pro with a 2.9 GHz Quad-Core Intel Core i7 processor and 16 GB of RAM.
This benchmark extracts all files in the Replit Desktop app's app.asar
file.
Command | Mean [ms] | Min [ms] | Max [ms] | Relative |
---|---|---|---|---|
./node_modules/.bin/asar extract test/ignore/app.asar test/ignore/app1 | 670.0 ± 52.6 | 614.6 | 739.4 | 1.54 ± 0.41 |
bun ./src/cli/index.ts extract test/ignore/app.asar test/ignore/app2 | 435.1 ± 110.9 | 373.7 | 632.3 | 1.00 |
Summary: fast-asar
is 1.54 ± 0.41 times faster than @electron/asar
.
To run this benchmark yourself, run bun run benchmark:extract
.
This benchmark packs the src
directory into an ASAR archive at test/ignore/src.asar
.
Command | Mean [ms] | Min [ms] | Max [ms] | Relative |
---|---|---|---|---|
./node_modules/.bin/asar pack src test/ignore/src.asar | 154.7 ± 45.3 | 123.4 | 231.7 | 1.93 ± 0.57 |
bun ./src/cli/index.ts pack src test/ignore/src.asar | 80.0 ± 3.1 | 77.6 | 85.4 | 1.00 |
Summary: fast-asar
is 1.93 ± 0.57 times faster than @electron/asar
.
To run this benchmark yourself, run bun run benchmark:pack
.
This benchmark lists all files in the Replit Desktop app's app.asar
file.
Command | Mean [ms] | Min [ms] | Max [ms] | Relative |
---|---|---|---|---|
./node_modules/.bin/asar list test/ignore/app.asar | 136.0 ± 31.3 | 117.5 | 191.5 | 1.28 ± 0.30 |
bun ./src/cli/index.ts list test/ignore/app.asar | 106.0 ± 5.9 | 101.3 | 116.2 | 1.00 |
Summary: fast-asar
is 1.28 ± 0.30 times faster than @electron/asar
.
To run this benchmark yourself, run bun run benchmark:list
.
For the tests, you must have the Replit Desktop app's app.asar
file in the test/ignore
directory.
You can get this file by installing the Replit Desktop app and copying the app.asar
file from the installation directory.
Then, to run all tests:
bun pretest
bun test
FAQs
A faster implementation of Electron's ASAR archive format.
The npm package fast-asar receives a total of 2 weekly downloads. As such, fast-asar popularity was classified as not popular.
We found that fast-asar demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Four npm packages disguised as cryptographic tools steal developer credentials and send them to attacker-controlled Telegram infrastructure.
Security News
Ruby maintainers from Bundler and rbenv teams are building rv to bring Python uv's speed and unified tooling approach to Ruby development.
Security News
Following last week’s supply chain attack, Nx published findings on the GitHub Actions exploit and moved npm publishing to Trusted Publishers.