
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
node-crc16
Advanced tools
A native node addon to calcalate and verify CRC16 values, adopted by MODBUS agreement.
MODBUS is an application-layer messaging protocol, positioned at level 7 of the OSI model. It provides client/server communication between devices connected on different types of buses or networks.The CRC(Cyclic Redundancy Check) part in protocol, such as MODBUS over serial line(Page 42), and Modbus-RTU(Page 75), adopt the same one algorithm.
node-crc16 implement the c++ version of this algorithm by table look-up, and also provide a node native addon and a nodejs version wrapper.
This module has been well unit tested and documented.
If your version of node.js is lower than v8.x.x, please use the latest v1.x.x of this module, or you should select v2.x.x, which uses NAPI to implement native addon gracefully and compatibly.
Tips: the most intuitive decription about this module is the comment in src and the code in unit test :).
npm install node-crc16
crc16.checkSumcheckSumaccept three params, the first two params (input, [encoding]) construct a Buffer
crc16.checkSum('utf8 string', 'utf8')
default encoding is hex
var sum = crc16.checkSum('a031ffb7');
sum.should.equal('726d');
the third param is option,which type is Object
option.retType set the format of the returned sum
hex,two bytes BigEndian hex string, 726darray, two unsigned char number of the returned sum,[114, 109]int,one unsigned short number of the returned sum,29293buffer,Buffer type of the returned sum,<Buffer 72 6d>var sum = crc16.checkSum('a031ffb7', {retType: 'array'});
sum.should.eql([114, 109]);
crc16.verifySumParams of verifySum is same as checkSum, the first two params are used to constructe a Buffer which contains the sum to be verified.
var stream = 'a031ffb7',
sum = '726d';
var isValid = crc16.verifySum(stream + sum);
isValid.should.equal(true);
# fork and clone the code to your local env
git clone git@github.com:imnemo/crc16.git
cd crc16
├── lib //CRC16 algorithm implemention in c++
├── util //Util functions
├── src //Node Native Addon
├── test //JS unit testing
├── test_cpp //C++ unit testing
├── index.js //Main entry of NodeJS module
npm install
The implemention of CRC16 checking and verifing algorithm in c++ is standalone in ./lib/crc16.cc. If you want to modify it, please write suitable unittest cases. You can reference Catch, and then run:
make test
Make sure all the unit testing case is passed after you modify.
npm test or ./node_modules/.bin/mocha --reporter spec
>>> npm run benchmark
> node-crc16@1.0.0 benchmark /Users/nemo/code/imnemo/crc16
> node benchmark/benchmark.js
CEC16#checkSum x 905,071 ops/sec ±2.00% (83 runs sampled)
CRC16#verifySum x 1,540,940 ops/sec ±19.92% (65 runs sampled)
Fastest is CRC16#verifySum
>>> npm run nanobench
> node-crc16@1.0.0 nanobench /Users/nemo/code/imnemo/crc16
> node benchmark/nanobench.js
NANOBENCH version 2
> /Users/nemo/.nvm/versions/node/v8.1.2/bin/node benchmark/nanobench.js
# CRC16#checkSum 2,000,000 times
ok ~3.17 s (3 s + 166422442 ns)
# CRC16#verifySum 2,000,000 times
ok ~2.85 s (2 s + 848059820 ns)
all benchmarks completed
ok ~6.01 s (6 s + 14482262 ns)
You can pull a request when you complete all steps above.
index.js.dtwitter: @imoncoding
Welcome to subscribe my wechat!
FAQs
A native node addon to calcalate and verify CRC16 values, adopted by MODBUS agreement.
The npm package node-crc16 receives a total of 1,336 weekly downloads. As such, node-crc16 popularity was classified as popular.
We found that node-crc16 demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.