
Research
Malicious fezbox npm Package Steals Browser Passwords from Cookies via Innovative QR Code Steganographic Technique
A malicious package uses a QR code as steganography in an innovative technique.
Simple tool for obsfucating ObjectID used by MongoDB. The name is a really lame contraction of mongo and obfuscate. :P
Use this utility to obfuscate ObjectID issued by MongoDB when you use them in your API. It's always a good idea not to expose anything to the outside world, and this helps you keep your IDs a bit more secure.
You can now pass in your own function for swapping and xor'ing. You have to bear in mind, though, that the swap
function should be "symmetrical". Basically, this means that swap_func(swap_func(x)) === x
. In a real project, you
would send an obfuscated version of x, which is de-obfuscated by obfuscating that value again.
Internally, the obfuscating function works like this:
var obfuscated_value = xor_func(swap_func(xor_func(x)));
XOR is symmetrical implictly, as long as it's the same value you're xor'ing with.
In the end, the obfuscating function must be symmetrical:
obfuscate(obfuscate(x)) === x;
should evaluate to true.
npm install monguscate --save
var Obfuscate = require('monguscate');
// You can create your own swap and xor methods (not mandatory)
var my_swap = function (x) {
// swap x in some manner (must be symmetrical)
};
var my_xor = function (x) {
// Perform xor on x in some manner
};
var O = new Obfuscate();
O.setXorCallback(my_xor); // override the default xor method
O.setSwapCallback(my_swap); // override the default swap method
var x = '54f457292f559f0761000003'; // This is what an ObjectID looks like as a String
var obfuscated_x = O.obfuscate(x);
console.log('ObjectID ', x, 'obfuscated ObjectID ', obfuscated_x);
var obfuscate = require('monguscate').obfuscate;
var x = '54f457292f559f0761000003'; // This is what an ObjectID looks like as a String
var obfuscated_x = obfuscate(x);
console.log('ObjectID ', x, 'obfuscated ObjectID ', obfuscated_x);
npm test
FAQs
Obfuscate ObjectID as used by MongoDB.
The npm package monguscate receives a total of 2 weekly downloads. As such, monguscate popularity was classified as not popular.
We found that monguscate demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
A malicious package uses a QR code as steganography in an innovative technique.
Research
/Security News
Socket identified 80 fake candidates targeting engineering roles, including suspected North Korean operators, exposing the new reality of hiring as a security function.
Application Security
/Research
/Security News
Socket detected multiple compromised CrowdStrike npm packages, continuing the "Shai-Hulud" supply chain attack that has now impacted nearly 500 packages.