Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
A script that appends hashes to filenames, import paths, and any other links for your web project.
A script that appends hashes to filenames, import paths, and any other links that connect the resources within your entire web project.
The script requires an HTML entry point to begin. It scans the page for links specifically
those with src=""
or href=""
, and follow these links to subsequent files. For each files,
depending on its content type (e.g, .js, .css) the script performs an additional scan to identify and
track any further links to other resources. For example, when processing a JS file, the script looks
for patterns such as import
, fetch
, request
, and url
.
As it processes each resource, the script generates a unique hash based on the file's content and appends this hash to the corresponding links. Simultaneously, the script copies all the files to an output folder, ensuring that resources are organized and properly linked.
This script is designed to work with any web project, as long as it used as a post-build step in your workflow.
Force the update of your website for users who most likely have a cached version. By changing the file path, the browser is forced to fetch the latest version, ensuring users get the update immediately without needing to manually clear their cache or wait for it to expire.
If a file doesn't change, its hash remains the same, and the browser will serve the cached version regardless.
hash-web ./public/index.html ./build
hash_web({
input: `./public/index.html`,
output_dir: `./build`
});
Ext | Patterns |
---|---|
.html | src="" , href="" , <script></script> , srcset="" , <object data=""> , content="" |
.css | url("") |
.js | import , fetch , new URL , new Request |
.webmanifest | "src": "" |
FAQs
A script that appends hashes to filenames, import paths, and any other links for your web project.
The npm package hash-web receives a total of 17 weekly downloads. As such, hash-web popularity was classified as not popular.
We found that hash-web demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.