Research
Security News
Threat Actor Exposes Playbook for Exploiting npm to Build Blockchain-Powered Botnets
A threat actor's playbook for exploiting the npm ecosystem was exposed on the dark web, detailing how to build a blockchain-powered botnet.
jscrambler
Advanced tools
You may put your access and secret keys into a config file if found in these directories. Besides simplifying the command entry, this has the added benefit of not logging your JScrambler credentials.
Here's an example of what your .jscramblerrc
file should look like:
{
"host": "api4.jscrambler.com",
"port": 443,
"keys": {
"accessKey": "AAAA",
"secretKey": "SSSS"
},
"applicationId": "XXXXX",
"filesSrc": [
"/path/to/src.html",
"/path/to/src.js"
],
"filesDest": "/path/to/destDir/",
"params": {
// transformations
"stringSplitting": {
// transformation options
"chunk": 1
}
}
}
Please, replace the AAAA
, SSSS
and XXXXX
placeholders with your API credentials and Application ID.
npm install -g jscrambler
Usage: jscrambler [options] <file ...>
Options:
-h, --help output usage information
-V, --version output the version number
-a, --access-key <accessKey> Access key
-c, --config <config> JScrambler configuration options
-h, --host <host> Hostname
-i, --application-id <id> Application ID
-o, --output-dir <dir> Output directory
-p, --port <port> Port
-s, --secret-key <secretKey> Secret key
When making API requests you must pass valid secret and access keys, through the command line or by having a .jscramblerrc
file. These keys are each 40 characters long, alpha numeric strings, and uppercase. You can find them in your jscramber web dashboard under My Profile > API Credentials
. In the examples these are shortened to AAAA
and SSSS
for the sake of readability.
jscrambler -a AAAA -s SSSS -i APP_ID -o output.js input.js
jscrambler -a AAAA -s SSSS -i APP_ID -o output/ input1.js input2.js
jscrambler -a AAAA -s SSSS -i APP_ID -o output/ "lib/**/*.js"
jscrambler -c config.json
where config.json
is an object optionally containing any of the JScrambler options listed here, using the structure described in the RC configuration.
npm install javascript-jscrambler
import jScrambler from 'javascript-jscrambler';
(async () => {
try {
await jScrambler
.protectAndDownload({
keys: {
accessKey: 'AAAA',
secretKey: 'SSSS'
},
host: 'api4.jscrambler.com',
port: 443,
applicationId: 'APP_ID',
filesSrc: [
'/path/to/src.html',
'/path/to/src.js'
],
filesDest: '/path/to/destDir/',
params: {
stringSplitting: {
chunk: 1
}
}
});
} catch (err) {
console.error(err);
}
})();
Please refer to docs for more information.
FAQs
Jscrambler API client.
The npm package jscrambler receives a total of 5,844 weekly downloads. As such, jscrambler popularity was classified as popular.
We found that jscrambler demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 9 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A threat actor's playbook for exploiting the npm ecosystem was exposed on the dark web, detailing how to build a blockchain-powered botnet.
Security News
NVD’s backlog surpasses 20,000 CVEs as analysis slows and NIST announces new system updates to address ongoing delays.
Security News
Research
A malicious npm package disguised as a WhatsApp client is exploiting authentication flows with a remote kill switch to exfiltrate data and destroy files.