Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
incoming-message-hash
Advanced tools
Generate a one-way hash from an http.IncomingMessage
$ npm install incoming-message-hash --save
This example demonstrates how the hashing function returns a different hash based on the IncomingMessage's method, path, query string, headers and body.
import hash from 'incoming-message-hash'
import { createServer } from 'http'
createServer((req, res) => {
req.pipe(hash()).pipe(res)
}).listen(4567, () => {
console.log('Server is listening on port 4567');
})
$ curl http://localhost:4567; echo
e91caf6d7b009b5af0fb2e18cff95598
$ curl http://localhost:4567/foo; echo
2f24d536fd0ca7c4eb72a8d64440066f
$ curl http://localhost:4567/foo?a=b; echo
0bb92c398df54668d9020b835c345cb8
$ curl http://localhost:4567/foo?a=c; echo
02bd995c9ebccfc0332619a03ce0a688
$ curl -H "Host: www.flickr.com" http://localhost:4567; echo
ce8f3e6257911a9499923d0deebe56b5
$ curl -X POST http://localhost:4567; echo
41ba64dca3f3070b361b302a17742973
$ curl -X POST -d "yay" http://localhost:4567; echo
64ae029a6a4add75fadb03811a13caa7
var hash = require('incoming-message-hash');
Returns a new crypto.Hash stream using the specified algorithm and encoding (defaults to "md5" and "hex"). You can pipe your http.IncomingMessage in and get a hash back.
import hash from 'incoming-message-hash'
import { createServer } from 'http'
createServer((req, res) => {
req.pipe(hash()).pipe(res)
})
Synchronous version of hash()
that accepts an http.IncomingMessage and its body and returns the hash. You must buffer up the request body yourself if you wish to use this method.
import { promise } from 'incoming-message-hash'
import { createServer } from 'http'
createServer(async function (req, res) {
let body = ''
req.on('data', chunk => body += String(chunk))
req.on('end', () => {
res.end(sync(req, body))
})
})
Asynchronous version of hash()
that accepts an http.IncomingMessage and
buffers the body up for you.
import { promise } from 'incoming-message-hash'
import { createServer } from 'http'
createServer(async (req, res) => {
res.end(await promise(req))
})
This software is free to use under the MIT license. See the LICENSE file for license text and copyright information.
FAQs
Generate a one-way hash from an http.IncomingMessage
The npm package incoming-message-hash receives a total of 1,481 weekly downloads. As such, incoming-message-hash popularity was classified as popular.
We found that incoming-message-hash demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.