
Security News
The Hidden Blast Radius of the Axios Compromise
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.
Node.js library for encrypted file transfer on the GenaroNetwork network via bindings to libgenaro.
Install via npm:
npm install libgenaro
First setup the storj environment with authentication and encryption options:
const { Environment } = require('libgenaro');
const libgenaro = new Environment({
bridgeUrl: 'http://111.111.111.111:8080',
keyFile: `{
"address": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
"crypto":{"ciphertext":"bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
"cipherparams":{"iv":"cccccccccccccccccccccccccccccccc"},"cipher":"aes-128-ctr",
"kdf":"scrypt","kdfparams":{"dklen":32,"salt":"dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd","n":262144,"r":8,
"p":1},"mac":"eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee"},
"id": "ffffffff-1111-2222-3333-444444444444",
"version": 3
}
`,
passphrase: '123456',
});
Upload a file to a bucket:
const bucketId = '368be0816766b28fd5f43af5';
const filePath = './test-upload.data';
const keyCtr = env.generateEncryptionInfo(bucketId);
const index = keyCtr.index;
const key = keyCtr.key;
const ctr = keyCtr.ctr;
const rsaKey = xxxxxx; // encrypted key with rsa
const rsaCtr = xxxxxx; // encrypted ctr with rsa
const state = libgenaro.storeFile(bucketId, fileOrData, isFilePath, {
filename: 'test-upload.data',
progressCallback: function(progress, fileBytes) {
console.log('Progress:', progress);
},
finishedCallback: function(err, fileId, fileBytes, sha256_of_encrypted) {
if (err) {
return console.error(err);
}
console.log('File complete:', fileId);
},
index: index,
key: key,
ctr: ctr,
rsaKey: rsaKey,
rsaCtr: rsaCtr,
});
Download a file from a bucket:
const bucketId = '368be0816766b28fd5f43af5';
const fileId = '998960317b6725a3f8080c2b';
const downloadFilePath = './test-download.data';
const key = xxxxxx; // the file encryption key
const ctr = xxxxxx; // the file encryption ctr
const state = libgenaro.resolveFile(bucketId, fileId, filePath, {
key: key,
ctr: ctr,
overwrite: overwrite,
decrypt: decrypt,
progressCallback: function(progress, fileBytes) {
console.log('progress:', progress);
},
finishedCallback: function(err, fileBytes, sha256) {
if (err) {
return console.error(err);
}
console.log('File download complete');
}
});
Once finished, you should call to zero and free memory holding encryption keys:
libgenaro.destroy();
Environment(options) - A constructor for keeping encryption options and other environment settings, see available methods belowMethods available on an instance of Environment:
getInfo(function(err, result) {}) - Get general API info`getBuckets(function(err, result) {}) - Get list of available bucketsdeleteBucket(bucketId, function(err, result) {}) - Delete a bucketrenameBucket(bucketId, function(err) {}) - Rename a bucketlistFiles(bucketId, function(err, result) {}) - List files in a bucketstoreFile(bucketId, fileOrData, isFilePath, options) - Upload a file, return state objectstoreFileCancel(state) - Cancel an uploadresolveFile(bucketId, fileId, filePath, options) - Download a file, return state objectresolveFileCancel(state) - Cancel a downloaddeleteFile(bucketId, fileId, function(err, result) {}) - Delete a file from a bucketgenerateEncryptionInfo(bucketId) - Generate the key and ctr of AES-256-CTR for file encryption, and also the index related to the key and ctr, return undefined if faildecryptFile(filePath, key, ctr) - Decrypt the undecrypted file use the key and ctr of AES-256-CTR, return the decrypted data if success, undefined if failencryptMeta(meta) - Encrypt the meta use AES-256-GCM combined with HMAC-SHA512, return the encrypted meta if success, undefined if failencryptMetaToFile(meta, filePath) - Encrypt the meta use AES-256-GCM combined with HMAC-SHA512 to filePathdecryptMeta(encryptedMeta) - Decrypt the encryptedMeta, return the decrypted meta if success, undefined if faildecryptMetaFromFile(filePath) - Decrypt the data in filePath, return the decrypted data if success, undefined if faildestroy() - Zero and free memory of encryption keys and the environmentFAQs
Node.js library for encrypted file transfer on the Genaro network.
We found that libgenaro demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.