Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
idb-file-storage
Advanced tools
Status: Prototype/Proposal.
This library wraps some of the IndexedDB features related to store files into a Promised API.
While on Chrome this library only provides a basic API to store File and Blob instances, on Firefox it also provides a Promise based API wrapper for the non-standard IDBMutableFile API.
The non-standard IDBMutableFile API allows to create and optionally persist into the an IndexedDB database a file object which provides an API to be able to read and change the file content without loading all its content in the memory.
This library should allow WebExtensions add-ons to be able to store and manipulate files more efficiently, without providing direct access to arbitrary files on the user filesystem.
The Promise based IDBMutableFile API is currently not available when this library runs on Chrome (e.g. as a Chrome extension), but it still works for storing and retrieving Blob and File instances. Even if not yet implemented, providing a polyfill for the IDBMutableFile API on Chrome based on Blob instances is technically possible.
A more detailed API reference (generated using esdoc from the inline comments), and a collection of small examples are available at the following urls:
The library is wrapped as an UMD module, and so it can be included as a CommonJS module using a CommonJS module loader (e.g. webpack, browserify, rollup, ...) or as an AMD module from a AMD module loader (e.g. RequireJS), as well as just included as a tag script into an HTML page.
async function testIDBFiles() {
const tmpFiles = await IDBFiles.getFileStorage({name: "tmpFiles"});
const file = await tmpFiles.createMutableFile("path/filename.txt");
const fh = file.open("readwrite");
const metadata = await fh.getMetadata();
console.log(metadata.size); // -> 0
await fh.append("new file content");
const metadata = await fh.getMetadata();
console.log(metadata.size); // -> updated size
await fh.close();
await file.persist();
const fileNames = await tmpFiles.list();
console.log(fileNames); // -> ["path/filename.txt"]
const file = await tmpFiles.get("path/filename.txt");
// Only open if its a mutable file.
if (file.open) {
const fh = file.open("readonly");
const metadata = await fh.getMetadata();
console.log(metadata.size); // -> updated size
}
await tmpFiles.clear(); // or tmpFiles.remove("path/filename.txt")
const fileNames = await tmpFiles.list();
console.log(fileNames); // -> []
}
Building the source file into a UMD module (and lint the javascript sources in the process):
$ npm run build
...
Running the karma tests (which also builds the library and open a Chrome and a Firefox instance and run the test on both):
$ npm run test
While working on the library or test sources, you may want to watch the sources for changes and lint, rebuild and re-run the tests accordingly:
$ npm run test:watch
FAQs
Simple Promise-based IndexedDB wrapper to store files
The npm package idb-file-storage receives a total of 258 weekly downloads. As such, idb-file-storage popularity was classified as not popular.
We found that idb-file-storage demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.