
Research
Malicious npm Packages Impersonate Flashbots SDKs, Targeting Ethereum Wallet Credentials
Four npm packages disguised as cryptographic tools steal developer credentials and send them to attacker-controlled Telegram infrastructure.
A script that appends hashes to filenames, import paths, and any other links for your web project.
A script that appends hashes to filenames, import paths, and any other links that connect the resources within your entire web project.
The script requires an HTML entry point to begin. It scans the page for links specifically
those with src=""
or href=""
, and follow these links to subsequent files. For each files,
depending on its content type (e.g, .js, .css) the script performs an additional scan to identify and
track any further links to other resources. For example, when processing a JS file, the script looks
for patterns such as import
, fetch
, request
, and url
.
As it processes each resource, the script generates a unique hash based on the file's content and appends this hash to the corresponding links. Simultaneously, the script copies all the files to an output folder, ensuring that resources are organized and properly linked.
This script is designed to work with any web project, as long as it used as a post-build step in your workflow.
Force the update of your website for users who most likely have a cached version. By changing the file path, the browser is forced to fetch the latest version, ensuring users get the update immediately without needing to manually clear their cache or wait for it to expire.
If a file doesn't change, its hash remains the same, and the browser will serve the cached version regardless.
hash-web ./public/index.html ./build
hash_web({
input: `./public/index.html`,
output_dir: `./build`
});
Ext | Patterns |
---|---|
.html | src="" , href="" , <script></script> , srcset="" , <object data=""> , content="" |
.css | url("") |
.js | import , fetch , new URL , new Request |
.webmanifest | "src": "" |
FAQs
A script that appends hashes to filenames, import paths, and any other links for your web project.
The npm package hash-web receives a total of 7 weekly downloads. As such, hash-web popularity was classified as not popular.
We found that hash-web demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Four npm packages disguised as cryptographic tools steal developer credentials and send them to attacker-controlled Telegram infrastructure.
Security News
Ruby maintainers from Bundler and rbenv teams are building rv to bring Python uv's speed and unified tooling approach to Ruby development.
Security News
Following last week’s supply chain attack, Nx published findings on the GitHub Actions exploit and moved npm publishing to Trusted Publishers.