Research
Security News
Malicious npm Package Targets Solana Developers and Hijacks Funds
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
grunt-zip-to-crx
Advanced tools
Generates chrome extension files (.crx) from zipped projects.
Chrome extension is zipped electronically signed file. Signature is distributed together with packed content inside .crx file.
This plugin is not able to generate zip itself, mostly because grunt-contrib-compress does a good job and is actively maintained by grunt team. Use it to pack your extension files. Once you have .zip with manifest.json
and everything else inside, this plugin will sign it and generate chrome extension (.crx) file.
Resources:
The project requires openssl
installed and available on path. Windows and solaris distributions are available here.
Note: I would like to remove this dependency. Unfortunately, that requires me to decode/encode ans1 files. Although decoder is available, I did not found encoder yet.
There is another project grunt-crx able to generate .crx files. Its main advantage is ability to both zip files and sign files, so you might want to give it a try. Its main disadvantage is speed - it copies everything into temporary directory, then deletes excluded files and packs the result. This is fine on small projects or when you have all extension files in separate directory. However, it may end up copying a lot of files (whole .git
directory) on some projects and that was very slow.
Install this plugin with this command:
npm install grunt-zip-to-crx --save-dev
Installed plugin is enabled inside Gruntfile with this line of JavaScript:
grunt.loadNpmTasks('grunt-zip-to-crx');
The zip_to_crx needs to know:
Private key must be stored in a pem encoded file. OpenSSL is able to generate such files from command line. Use either of these two commands:
# generate password protected private key file
openssl genrsa -des3 -out private-key.pem 2048
# generate private key without password
openssl genrsa -out private-key.pem 2048
Both create private-key.pem
file with newly generated private key inside current directory.
Zip_to_crx task requires privateKey
option property. Its value must be a string and must contain path to pem encoded private key file.
Example:
options: {
// Location of pem encoded private key.
privateKey: "../ssl-keys/private-key.pem"
}
Input and output files are configured using the usual src
and dest
pairs. Source property src
may contain either a path towards .zip file or a list of them.
Examples:
src: 'path/to/file.zip'
,src: 'all/in/this/directory/*.zip'
src: ['path/to/file.zip', 'different/zipped.zip', 'globbing/*.zip']
.Destination property dest
must contain path to single directory ended by a slash /
or single filename. If the src
property references multipe files, then the dest
must contain directory.
Examples:
dest: 'path/to/file.crx'
,dest: 'path/to/directory/
.Destination property is optional. If the dest
does not specify filename, e.g. is empty or contains a directory, plugin guesses output filename from input file name.
First three examples show three different ways how to configure zip_to_crx task. Last example shows whole Grunt.js file, including grunt-contrib-compress part.
Find all .zip files in tmp/
directory, sign them and place results into the distribution
directory:
grunt.initConfig({
zip_to_crx: {
options: {
// Location of pem encoded private key.
privateKey: "../ssl-keys/private-key.pem"
},
your_target: {
// all zip files in tmp are assumed to be future extentions
src: "tmp/*.zip",
// .crx will be placed in the distribution directory
dest: "distribution/"
},
},
});
Convert tmp/my-supercool-extension-<version>.zip
into distribution/my-supercool-extension-<version>.crx
file:
grunt.initConfig({
zip_to_crx: {
options: {
// Location of pem encoded private key.
privateKey: "../ssl-keys/private-key.pem"
},
your_target: {
// input zip file
src: "tmp/my-supercool-extension-<version>.zip",
// output .crx file
dest: "distribution/my-supercool-extension-<version>.crx"
},
},
});
If the dest
ends with slash /
, plugin will treat it as a directory. .crx file name is guessed from input .zip file name. This generates the same output file as the previous configuration:
grunt.initConfig({
zip_to_crx: {
options: {
// Location of pem encoded private key.
privateKey: "../ssl-keys/private-key.pem"
},
your_target: {
// input zip file
src: "tmp/my-supercool-extension-<version>.zip",
// output .crx file
dest: "distribution/"
},
},
});
Example configuration that does both zipping and signing. It generates the same output file as previous two examples:
module.exports = function(grunt) {
grunt.initConfig({
compress: {
main: {
options: {
archive: 'tmp/my-supercool-extension.zip'
},
files: [
{src: ['_locales/**']},
{src: ['doc/**']},
{src: ['icons/**']},
{src: ['lib/**']},
{src: ['skin/**']},
{src: ['src/**']},
{src: ['tests/**']},
{src: ['manifest.json']}
]
}
},
zip_to_crx: {
options: {
// Location of pem encoded private key.
privateKey: "../ssl-keys/private-key.pem"
},
your_target: {
// input zip file
src: "tmp/my-supercool-extension.zip",
// output .crx file
dest: "distribution/"
},
},
});
grunt.loadNpmTasks('grunt-contrib-compress');
grunt.loadNpmTasks('grunt-zip-to-crx');
grunt.registerTask('build', ['compress', 'zip_to_crx']);
};
Take care to maintain the existing coding style. Add unit tests for any new or changed functionality. Lint and test your code using Grunt.
(Nothing yet)
FAQs
Converts zipped files into chrome extension file (.crx).
The npm package grunt-zip-to-crx receives a total of 2 weekly downloads. As such, grunt-zip-to-crx popularity was classified as not popular.
We found that grunt-zip-to-crx demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
Security News
Research
Socket researchers have discovered malicious npm packages targeting crypto developers, stealing credentials and wallet data using spyware delivered through typosquats of popular cryptographic libraries.
Security News
Socket's package search now displays weekly downloads for npm packages, helping developers quickly assess popularity and make more informed decisions.