
Security News
/Research
npm Phishing Email Targets Developers with Typosquatted Domain
A phishing attack targeted developers using a typosquatted npm domain (npnjs.com) to steal credentials via fake login pages - watch out for similar scams.
incoming-message-hash
Advanced tools
Generate a one-way hash from an http.IncomingMessage
$ npm install incoming-message-hash --save
This example demonstrates how the hashing function returns a different hash based on the IncomingMessage's method, path, query string, headers and body.
import hash from 'incoming-message-hash'
import { createServer } from 'http'
createServer((req, res) => {
req.pipe(hash()).pipe(res)
}).listen(4567, () => {
console.log('Server is listening on port 4567');
})
$ curl http://localhost:4567; echo
e91caf6d7b009b5af0fb2e18cff95598
$ curl http://localhost:4567/foo; echo
2f24d536fd0ca7c4eb72a8d64440066f
$ curl http://localhost:4567/foo?a=b; echo
0bb92c398df54668d9020b835c345cb8
$ curl http://localhost:4567/foo?a=c; echo
02bd995c9ebccfc0332619a03ce0a688
$ curl -H "Host: www.flickr.com" http://localhost:4567; echo
ce8f3e6257911a9499923d0deebe56b5
$ curl -X POST http://localhost:4567; echo
41ba64dca3f3070b361b302a17742973
$ curl -X POST -d "yay" http://localhost:4567; echo
64ae029a6a4add75fadb03811a13caa7
var hash = require('incoming-message-hash');
Returns a new crypto.Hash stream using the specified algorithm and encoding (defaults to "md5" and "hex"). You can pipe your http.IncomingMessage in and get a hash back.
import hash from 'incoming-message-hash'
import { createServer } from 'http'
createServer((req, res) => {
req.pipe(hash()).pipe(res)
})
Synchronous version of hash()
that accepts an http.IncomingMessage and its body and returns the hash. You must buffer up the request body yourself if you wish to use this method.
import { promise } from 'incoming-message-hash'
import { createServer } from 'http'
createServer(async function (req, res) {
let body = ''
req.on('data', chunk => body += String(chunk))
req.on('end', () => {
res.end(sync(req, body))
})
})
Asynchronous version of hash()
that accepts an http.IncomingMessage and
buffers the body up for you.
import { promise } from 'incoming-message-hash'
import { createServer } from 'http'
createServer(async (req, res) => {
res.end(await promise(req))
})
This software is free to use under the MIT license. See the LICENSE file for license text and copyright information.
FAQs
Generate a one-way hash from an http.IncomingMessage
We found that incoming-message-hash demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
/Research
A phishing attack targeted developers using a typosquatted npm domain (npnjs.com) to steal credentials via fake login pages - watch out for similar scams.
Security News
Knip hits 500 releases with v5.62.0, refining TypeScript config detection and updating plugins as monthly npm downloads approach 12M.
Security News
The EU Cyber Resilience Act is prompting compliance requests that open source maintainers may not be obligated or equipped to handle.