
Research
Two Malicious Rust Crates Impersonate Popular Logger to Steal Wallet Keys
Socket uncovers malicious Rust crates impersonating fast_log to steal Solana and Ethereum wallet keys from source code.
Parses Valve's KeyValues aka VDF format.
Fully compliant with escape sequences and comments.
Import the package:
const {parse} = require('kvparser');
or
import {parse} from 'kvparser';
Pass a string to the parse
function, which will return an object. Since all KV structures begin with a named root key,
the output object will have exactly one property, the value of which is an object.
No extra processing is done to any data types. This means that all numbers are returned as strings. Additionally, proto-arrays are not automatically decoded into arrays. For example, this input data:
ExampleData
{
"some_key_1" "1"
"some_key_2" "1"
"some_key_3" "1"
}
Is decoded as:
{
"ExampleData": {
"some_key_1": "1",
"some_key_2": "1",
"some_key_3": "1"
}
}
Any data after the closing }
is ignored. Any sequence that begins with //
and terminates with a newline is treated
as a comment and is ignored.
Escape sequences are supported in quoted strings. Any backslash characters inside a quoted string are removed, and the following character is rendered as-is. Here are some example escape sequences and what they parse into:
"\""
becomes '"'
"\\"
becomes '\\'
(a string containing a single backslash, which JavaScript serializes into an escaped backslash)"\n"
becomes 'n'
FAQs
Parses VDF/KeyValues, used Steam and Source engine games
The npm package kvparser receives a total of 5,558 weekly downloads. As such, kvparser popularity was classified as popular.
We found that kvparser demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Socket uncovers malicious Rust crates impersonating fast_log to steal Solana and Ethereum wallet keys from source code.
Research
A malicious package uses a QR code as steganography in an innovative technique.
Research
/Security News
Socket identified 80 fake candidates targeting engineering roles, including suspected North Korean operators, exposing the new reality of hiring as a security function.