Research
Security News
Malicious npm Package Targets Solana Developers and Hijacks Funds
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
gun-fetch
Advanced tools
Fetch With GunDB
const path = require('path')
const options = {file: path.resolve('./storage'), relay: false}
// file: path where data will be saved
// relay: boolean, truthy means that gun-fetch will connect to relays, falsy means that gun-fetch will not connect to any relays
const gunFetch = require('gun-fetch')
const fetch = gunFetch(options)
let test = await fetch('gun://hello/test/testing', {method: 'GET'})
let testText = await test.text()
// show the data
console.log(testText)
HEAD
is now supportedgun-fetch uses special characters to make specific types of queries
Character | Type |
---|---|
_ | special queries |
- | hex encoded |
HEAD:
someHostName
or someHostName/somePath
, if data is found then code 200 is returned, no body is returned
_someHostName
or _someHostName/somePath
, if data is found then code 200 is returned, no body is returned
_
, only headers are used with a request, no body is returned
HEADERS:
Authorization
, hostname must be _someUser
or _someUser/somePath
, makes a query for a user that is logged in and returns with a code 200 if the data is found
X-Node
, hostname must be _
, should contain a string which will be the url for the gundb relay, returns X-Node
header and code 200 if gun-fetch is connected to the relay
X-Nodes
, hostname must be _
, should contain a stringified javascript array which will contain the urls of gun relays, returns X-Nodes
and code 200 if gun-fetch is connected to all of the relays
X-Peer
, hostname must be _
, should contain a string which will be the url for the gundb relay, returns X-Peer
header and code 200 if gun-fetch connects to the relay
X-Peers
, hostname must be _
, should contain a stringified javascript array which will contain the urls of gun relays, returns X-Peers
and code 200 if gun-fetch connects to all of the relays
fetch('gun://_', {method: 'HEAD', headers: {'X-Node': 'https://some-gun.relay/gun'}})
| if the method is HEAD
and the hostname is only _
, then | gun.get(~@someuser)
\
fetch('gun://_someuser')
| if the text after _
does not contain special characters, then this will be a user/relay query | gun.get(~@someuser)
\
fetch('gun://_some.gun-key_here')
| if the text after the _
contains special characters, then it will be a public key query | gun.get(~some.pub-key_here)
\
fetch('gun://_', {method: 'PUT', body: JSON.stringify({user: 'someuser', pass: 'somepass'})})
| if there is only _
without any text, then this will be a user register/login query | gun.user()
\
fetch('gun://somedata')
| if there is no _
with text, then it will be a regular query | gun.get(somedata)
fetch('gun://somedata/someotherdata')
| if there is no _
with text, then it will be a regular query | gun.get(somedata).get(someotherdata)
fetch('gun://-736f6d657465737474657874')
| if there is a -
then it will decode the hex encoded query | - means decode 74657374696e67 which decodes into "testing", which means it will be gun.get(testing)
fetch('gun://_', {method: 'GET', headers: {'X-Alias': 'someAliasHere'}})
| if the headers have a headers['X-Alias']
key then it will return whether that alias is logged in or not
fetch('gun://some/data/to/paginate', {method: 'GET', headers: {'X-Paginate': 'someGunDBPaginateObject'}})
| if the headers have a headers['X-Alias']
key then it will return whether that alias is logged in or not
fetch('gun://some/data/to/check', {method: 'GET', headers: {'X-Not': 'true'}})
| if the headers have a headers['X-Alias']
key then it will return whether that alias is logged in or not
fetch('gun://_', {method: 'PUT', headers: {'X-Create': 'someAliasHere'}, body: 'somePasswordHere'})
| if the headers have a headers['X-Create']
key then a new user will be created like gun.user().create()
fetch('gun://_', {method: 'PUT', headers: {'X-Login': 'someAliasHere'}, body: 'somePasswordHere'})
| if the headers have a headers['X-Auth']
key then the user will be logged in like gun.user().auth()
fetch('gun://somedata/some/path/to/data', {method: 'PUT', headers: {'X-Set'}, body: JSON.stringify({message: 'message', data: 'data'})})
| if the headers have a headers['X-Set']
key then the data will be used in a gundb set query like gun.get('somedata').get('some').get('path').get('to').get('data').set({message: 'message', data: 'data'})
fetch('gun://somedata/some/path/to/data', {method: 'PUT', headers: {}, body: JSON.stringify({message: 'message', data: 'data'})})
| if the headers does not have a headers['X-Set']
key then the data will be used in a gundb put query like gun.get('somedata').get('some').get('path').get('to').get('data').put({message: 'message', data: 'data'})
fetch('gun://somedata/some/path/to/data', {method: 'DELETE', headers: {'X-Unset': 'true'}, body: JSON.stringify({message: 'message', data: 'data'})})
| if the headers have a headers['X-Set']
key then the data will be used in a gundb unset query like gun.get('somedata').get('some').get('path').get('to').get('data').unset({message: 'message', data: 'data'})
fetch('gun://somedata/some/path/to/data', {method: 'DELETE', headers: {}, body: JSON.stringify({message: 'message', data: 'data'})})
| if the headers does not have a headers['X-Unset']
key then the data will be null in a gundb put query like gun.get('somedata').get('some').get('path').get('to').get('data').put(null)
fetch('gun://_', {method: 'DELETE', headers: {'X-Logout': 'someAliasHere'}})
| if the headers have a headers['X-Logout']
key then the alias will be logged out like gun.user().leave()
fetch('gun://_', {method: 'DELETE', headers: {'X-Delete': 'somePasswordHere'}, body: 'somePasswordHere'})
| if the headers ave a headers['X-Delete']
key then the alias will be deleted like gun.user().delete()
more to come
FAQs
Fetch with GunDB
The npm package gun-fetch receives a total of 3 weekly downloads. As such, gun-fetch popularity was classified as not popular.
We found that gun-fetch demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
Security News
Research
Socket researchers have discovered malicious npm packages targeting crypto developers, stealing credentials and wallet data using spyware delivered through typosquats of popular cryptographic libraries.
Security News
Socket's package search now displays weekly downloads for npm packages, helping developers quickly assess popularity and make more informed decisions.