
Security News
vlt Launches "reproduce": A New Tool Challenging the Limits of Package Provenance
vlt's new "reproduce" tool verifies npm packages against their source code, outperforming traditional provenance adoption in the JavaScript ecosystem.
mega-mock mocks MEGA API servers. It's intended to be used to test MEGA clients.
npm install mega-mock
(or npm install -g mega-mock
)npx mega-mock
(or mega-mock
)http://localhost:3000/
as gatewaymock@test
with password mock
Ctrl+C
It will create a "mega-mock-data" folder. Uploaded files will be stored named as their handlers. Server state is stored in "state.json" when it stops. Temporary files, used on upload, are also stored in this folder and may remain if some error happens. Those files can be used during tests in order to check if clients tested are working as expected.
Install it using npm install mega-mock
then run the following:
const megamock = require('mega-mock')
const server = megamock({
dataFolder: 'path to the data folder', // required
visualize: true, // set to false to disable logging requests to console
state: {} // initial server state
})
// It returns a instance of http.Server
// (it uses zeit/micro internally)
server.listen(3000, '0.0.0.0')
// Current state is exposed in the `.state` property
server.state.users // a Map of uh => {files, shares}
server.state.shares // a Map of share => {handler, uh}
server.state.loginData // a Map of uh => {login data}
server.state.uploadStates // a Map of id => [file parts]
To make implementation simpler "uh" is used as the internal user identifier. Initial server state is normalized by casting data of each property using new Map
.
When using the module the data folder isn't created automatically. Also no users are registered: you can register users by following the "new account registration" instructions below.
The account login flow uses RSA encryption, so to simplify implementation the server use pre-generated data. This data can be generated by opening MEGA website and running this code in the console:
;(async function () {
// Change those as you want
let email = 'mock@test'
let password = 'mock'
const derivedKey = prepare_key_pw(password)
const derivedAes = new sjcl.cipher.aes(derivedKey)
const uh = stringhash(email, derivedAes)
// Default key is "mock", you can change it
const accountKey = [109, 111, 99, 107]
const u_k_aes = new sjcl.cipher.aes(accountKey)
// To keep implementation simple the uh is used as the internal user id,
// also the server reads it from the sid when handling API requests
const testSid = (uh + '_megamock'.repeat(4)).substr(0, 43)
const rsakey = await new Promise(resolve => {
const w = new Worker('/keygen.js')
w.onmessage = function (e) {
w.terminate()
resolve(e.data)
}
const workerSeed = new Uint8Array(256)
asmCrypto.getRandomValues(workerSeed)
w.postMessage([2048, 257, workerSeed])
})
console.log('Run server.state.loginData.set(%s, %s)', JSON.stringify(uh),
JSON.stringify({
csid: base64urlencode(crypto_rsaencrypt(base64urldecode(testSid), rsakey)),
privk: a32_to_base64(encrypt_key(u_k_aes, str_to_a32(crypto_encodeprivkey(rsakey)))),
k: a32_to_base64(encrypt_key(derivedAes, accountKey))
}))
}())
By now only version 1 accounts are supported, that's why the code above uses prepare_key_pw
.
FAQs
mega-mock mocks MEGA API servers
The npm package mega-mock receives a total of 11 weekly downloads. As such, mega-mock popularity was classified as not popular.
We found that mega-mock demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
vlt's new "reproduce" tool verifies npm packages against their source code, outperforming traditional provenance adoption in the JavaScript ecosystem.
Research
Security News
Socket researchers uncovered a malicious PyPI package exploiting Deezer’s API to enable coordinated music piracy through API abuse and C2 server control.
Research
The Socket Research Team discovered a malicious npm package, '@ton-wallet/create', stealing cryptocurrency wallet keys from developers and users in the TON ecosystem.