Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
node-machine-id
Advanced tools
The node-machine-id npm package provides a simple way to uniquely identify a machine. It generates a machine-specific ID that can be used for licensing, authentication, or any other scenario where a unique machine fingerprint is required.
Synchronous ID retrieval
This feature allows you to synchronously retrieve a unique machine ID.
const { machineIdSync } = require('node-machine-id');
let id = machineIdSync();
console.log(id);
Asynchronous ID retrieval
This feature allows you to asynchronously retrieve a unique machine ID.
const { machineId } = require('node-machine-id');
machineId().then(id => {
console.log(id);
});
Original value retrieval
This feature allows you to retrieve the original machine ID value without any hashing, providing the raw hardware ID.
const { machineIdSync } = require('node-machine-id');
let originalValue = machineIdSync({original: true});
console.log(originalValue);
The uuid package can generate unique identifiers, but unlike node-machine-id, it does not provide machine-specific IDs. Instead, it generates random or time-based UUIDs.
The os module in Node.js provides system-related utility methods. While it does not generate unique IDs, it can be used to gather system information that could contribute to generating a unique machine fingerprint.
This package provides detailed system, hardware, and OS information. It can be used to create a unique machine ID by combining various hardware and system information, but it does not provide a direct method to generate a machine ID like node-machine-id does.
Cross-platform unique machine (desktop) id discovery
Module based on OS native UUID/GUID which used for internal needs.
All others approaches requires elevated rights or much depends on hardware components, but this approach summarize the methods of selecting the most reliable unique identifier
MachineGuid
in registry
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography
(can be changed by administrator but with unpredictable consequences)It is generated during OS installation and won't change unless you make another OS updates or reinstall. Depending on the OS version it may contain the network adapter MAC address embedded (plus some other numbers, including random), or a pseudorandom number.
IOPlatformUUID
(the same Hardware UUID)
ioreg -rd1 -c IOPlatformExpertDevice
Value from I/O Kit registry in IOPlatformExpertDevice class
/var/lib/dbus/machine-id
(can be changed by root
but with unpredictable consequences)
http://man7.org/linux/man-pages/man5/machine-id.5.htmlThe /var/lib/dbus/machine-id file contains the unique machine ID of the local system that is set during installation. The machine ID is a single newline-terminated, hexadecimal, 32-character, lowercase machine ID string. When decoded from hexadecimal, this corresponds with a 16-byte/128-bit string.
The machine ID is usually generated from a random source during system installation and stays constant for all subsequent boots. Optionally, for stateless systems, it is generated during runtime at early boot if it is found to be empty.
The machine ID does not change based on user configuration or when hardware is replaced.
npm install node-machine-id
<Boolean>
, If true
return original value of machine id, otherwise return hashed value (sha-256), default: false
machineId
import {machineId, machineIdSync} from 'node-machine-id';
// Asyncronous call with async/await or Promise
async function getMachineId() {
let id = await machineId();
...
}
machineId().then((id) => {
...
})
// Syncronous call
let id = machineIdSync()
// id = c24b0fe51856497eebb6a2bfcd120247aac0d6334d670bb92e09a00ce8169365
let id = machineIdSync({original: true})
// id = 98912984-c4e9-5ceb-8000-03882a0485e4
machine-id
As a workaround you can generate new machine-ids for each instance (or container) with
dbus-uuidgen
and changed them in the respective > files:/etc/machine-id
and/var/lib/dbus/machine-id
. Thanks @stefanhuber
FAQs
Unique machine (desktop) id (no admin privileges required).
The npm package node-machine-id receives a total of 2,670,303 weekly downloads. As such, node-machine-id popularity was classified as popular.
We found that node-machine-id demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.