Research
Security News
Threat Actor Exposes Playbook for Exploiting npm to Build Blockchain-Powered Botnets
A threat actor's playbook for exploiting the npm ecosystem was exposed on the dark web, detailing how to build a blockchain-powered botnet.
An append-only log on IPFS.
ipfs-log
is a partially ordered linked list of IPFS hashes where each entry in the log points to all known heads (a head is a node that is not referenced by other nodes in the log).
The module works in Node.js and Browsers.
Originally created for, and currently used in, orbit-db - a distributed peer-to-peer database on IPFS
npm install ipfs-log
See examples for details and more examples.
const IPFS = require('ipfs')
const Log = require('ipfs-log');
const log = new Log(new IPFS(), 'A');
log.add('one')
.then((entry1) => {
console.log('Entry1:', entry1.hash, entry1.payload);
return log.add('two');
})
.then((entry2) => {
console.log('Entry2:', entry2.hash, entry2.payload);
console.log('Entry2.next:', entry2.next[0]); // == entry1.hash
});
The distribution package for browsers is located in dist/ipfslog.min.js
<html>
<head>
<meta charset="utf-8">
</head>
<body>
<script type="text/javascript" src="../../dist/ipfslog.min.js" charset="utf-8"></script>
<script type="text/javascript" src="../../node_modules/ipfs/dist/index.js" charset="utf-8"></script>
<script type="text/javascript">
const ipfs = new window.Ipfs();
const log = new Log(ipfs, 'A')
log.add('one')
.then((entry1) => {
console.log('Entry1:', entry1.hash, entry1.payload, entry1);
return log.add('two')
})
.then((entry2) => {
console.log('Entry2:', entry2.hash, entry2.payload, entry2);
console.log("Entry2.next:", entry2.next[0]);
});
</script>
</body>
</html>
const Log = require('ipfs-log');
Create a log. The first argument is an ipfs
instance which can be of type js-ipfs
or js-ipfs-api
. See https://github.com/ipfs/js-ipfs-api for IPFS api documentation.
const ipfs = require('ipfs')(); // ipfs javascript implementation
// Or
const ipfs = require('ipfs-api')(); // local ipfs daemon (go-ipfs)
const log = new Log(ipfs, 'userid', 'name of the log');
Add a log entry. Returns the added node
.
log.add({ some: 'data' });
log.add('text');
// log1.items ==> [{ some: 'data' }, 'text']
Joins the log with other
log. Fetches history up to 256 items, ie. items that are not in this log but referred to in items in other
.
// log1.items ==> ['A', 'B']
// log2.items ==> ['C', 'D']
log1.join(log2);
// log1.items ==> ['A', 'B', 'C', 'D']
Empties the log.
Returns all items in the log.
const items = log.items;
// items ==> ['A', 'B', 'C']
Returns items in the current batch. Current batch are the items in the log that have been added after the latest sync with another log.
const snapshot = log.snapshot;
// snapshot ==> { id: 'log id', items: ['A', 'B', 'C']}
All class methods take an ipfs
instance as the first parameter. The ipfs can be of js-ipfs
or js-ipfs-api
. See https://github.com/ipfs/js-ipfs-api for IPFS api documentation.
const ipfs = require('ipfs')(); // js-ipfs
// Or
const ipfs = require('ipfs-api')(); // local ipfs daemon
See Instance methods on how to use the log instance
Get the IPFS hash of this log. Returns a Promise
that resolves to an IPFS hash
.
Log.getIpfsHash(ipfs, log).then((hash) => console.log(hash));
// ==> 'Qm...abc123'
Create a log from an IPFS hash. Returns a Promise
that resolves to a Log
instance.
Log.fromIpfsHash(ipfs, hash).then((log) => console.log(log));
// ==> instance of Log
Create a log from a log snapshot. Returns a Promise
that resolves a Log
instance.
const original = new Log(ipfs, 'id')
// Add items to the original log
// ...
const snapshot = original.snapshot;
Log.fromSnapshot(ipfs, snapshot).then((log) => console.log(log));
// ==> log is instance of Log and contains the same entries as original log
npm install
npm test
The build script will build the distribution file for browsers.
npm run build
FAQs
Append-only log CRDT on IPFS
The npm package ipfs-log receives a total of 459 weekly downloads. As such, ipfs-log popularity was classified as not popular.
We found that ipfs-log demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 4 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A threat actor's playbook for exploiting the npm ecosystem was exposed on the dark web, detailing how to build a blockchain-powered botnet.
Security News
NVD’s backlog surpasses 20,000 CVEs as analysis slows and NIST announces new system updates to address ongoing delays.
Security News
Research
A malicious npm package disguised as a WhatsApp client is exploiting authentication flows with a remote kill switch to exfiltrate data and destroy files.