Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
This is a simple module meant to extract image URLS from imgur pages in a standard format despite differences in URL format.
Example:
var impurge = require('impurge');
impurge.purge("http://imgur.com/IvpcP", function (e,r) {
console.log(r)
});
will result in:
http://i.imgur.com/IvpcP.jpg
or for multiple images
var impurge = require('impurge');
impurge.purge("http://imgur.com/a/QgHRA", function (e,r) {
console.log(r)
});
will result in:
[ 'http://i.imgur.com/OzAiFJ5.jpg',
'http://i.imgur.com/AS76Rhx.jpg',
'http://i.imgur.com/gx436Y2.jpg' ]
It currently supports:
The test file included will check the currency of the regular expressions against live reddit data to ensure imgur is not changing link formats and will look for any it does not recognize.
A few additional methods that are used for testing the accuracy of the regex's:
impurge.is_imgur(url); //will output true if the url is imgur
The following takes a string input and will return an array of imgur links contained within a text input:
impurge.get_text_imgur_links(text); // will return an array of links
The following is a function to determine the link type (previously used internally)
impurge.determine_link_type(url, function(err, type, id, i_url){
//err is given if link is not recognized
//type is image_url, album_url, gallery_url, hash_url
//id is the id for the link (if applicable)
//i_url is the image url if this is a direct image
});
FAQs
takes any imgur url and returns an array of direct image files
The npm package impurge receives a total of 16 weekly downloads. As such, impurge popularity was classified as not popular.
We found that impurge demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.