Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
migrate-to-w3up
Advanced tools
Migrate files to web3.storage.
WEB3_TOKEN
environment variable from https://old.web3.storage/tokens/Please file an issue to suggest a migration source that you would use.
npm install -g migrate-to-w3up
⚠️ Warning! ⚠️
migrate-to-w3up
filter mode.migrate-to-w3up
You will then see a series of prompts asking you:
WEB3_TOKEN
environment variable, if set and user confirmsWEB3_TOKEN
that user inputs into promptmigrate-to-w3up --log /tmp/migrate-to-w3up.$(date +%s).log
will run the migration and write migration events to the provided logfile.
This includes UploadMigrationSuccess
and UploadMigrationFailure
events. The latter are logged along with the source upload that could not be migrated, and this allows the log file to serve as a source of uploads to be migrated in a second migration run to retry any failures.
# set this to a space did
MIGRATION_LOG_1="/tmp/migrate-to-w3up.$(date +%s).log"
migrate-to-w3up --log "$MIGRATION_LOG_1" --space "$W3_SPACE"
# wait quite some time
Because the log contains good records of any failures, you can use it to do a second migration run of any uploads that failed to migrate.
# MIGRATION_LOG_1 should be set from before
MIGRATION_LOG_2="/tmp/migrate-to-w3up.$(date +%s).log"
# retry migrating any uploads from UploadMigrationFailure
migrate-to-w3up log get-uploads-from-failures "$MIGRATION_LOG_1" | migrate-to-w3up --log "$MIGRATION_LOG_2" --space "$W3_SPACE"
# check for failures from second log. rinse and repeat?
migrate-to-w3up log get-uploads-from-failures "$MIGRATION_LOG_2"
You can also use migrate-to-w3up
as a unix filter.
Just pipe in ndjson of old.web3.storage Uploads objects.
# gets current w3cli space (requires jq).
# copypasta from `w3 space ls` to pick another one,
# or do `w3 space use <space>` first
W3_SPACE=$(w3 space info --json | jq '.did' -r)
# define a command to get uploads as migration source
alias w32023-export='npx @web3-storage/w3@latest list --json'
migrate-to-w3up --space="$W3_SPACE" \
< <(w32023-export) \
| tee -a /tmp/migrate-to-w3up.$(date +%s).log
# include the previous line only if you want a logfile
# this also works
# jq optional but useful for pretty printing
# https://jqlang.github.io/jq/
w32023-export | migrate-to-w3up --space="$W3_SPACE" | jq
Runs a single store/add
invocation with the provided CAR link and show the output (this is mostly for w3up debuggers).
# base32 multihash CAR link
migrate-to-w3up $W3_SPACE store/add --link ciqgrph67ihh4imym4pl6d4xlnfhgxycdr4hcm6g6ucnzuxzqsorpsq
# CIDv1 CAR link
migrate-to-w3up $W3_SPACE store/add --link bagbaieranc6p56qopyqzqzy6x4hzow2konpqehdyoez4n5ie3tjptbe5c7fa
Example
$ migrate-to-w3up $W3_SPACE store/add --link ciqgrph67ihh4imym4pl6d4xlnfhgxycdr4hcm6g6ucnzuxzqsorpsq
{
"ok": {
"link": {
"/": "bagbaieranc6p56qopyqzqzy6x4hzow2konpqehdyoez4n5ie3tjptbe5c7fa"
},
"with": "did:key:z6MkvSvQTdY87Rkazj3JiTquqQzjCAgWBuoWodPSHY6josAp",
"status": "done",
"allocated": 0
}
}
migrate-to-w3up/from-w32023
migrate
function that runs a migration, returning an AsyncIterable
of MigratedUpload<W32023Upload>
that includes ucanto receipts for every request sent to w3up as part of the migration.migrate-to-w3up
migrate
. If some options aren't provided as flags, and there is an interactive terminal, prompt the terminal for the options required to start a migration, e.g. selecting a source
of uploads and destination
(e.g. space DID).migrate
from w32023-to-w3up.js and interprets the results as CLI output
jq
to pretty print the ndjson output for ad-hoc exploration.FAQs
Migrate data from old web3.storage to w3up
We found that migrate-to-w3up demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.