Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
portal-sync
Advanced tools
Zero-config peer-to-peer encrypted live folder syncing that respects your .gitignore
Zero-config peer-to-peer encrypted live folder syncing tool that respects your .gitignore
. Not the 2007 video game.
Built on top of the Hypercore protocol with emphasis on being zero-config, secure, and decentralized.
# Requires node >=v12.22.1
$ npm i -g portal-sync
# Start using portal
$ portal new
# or
$ portal join [sessionID]
portal
, no further content can be downloaded from it. No data is stored anywhere except on the host device.portal
server that all data is routed through. portal
only uses public servers to maintain a DHT (distributed hash table) for peer discovery.portal
tracks which files have changed to avoid resyncing entire folders wherever possible.portal
session ID can view the data you share.Portal relies on a publish-subscribe event model to drive its render and update cycles. File tree structure and individual file statuses are stored in a trie structure known as the Registry. On the host side, there is a local Registry that listens to file changes on the host machine and broadcasts them to an append-only Hypercore that is used as an event log. A drive syncing hook listens for changes in the local registry and streams file changes from disk to a Hyperdrive. On the client side, a remote Registry listens for changes in the event log and replicates changes locally. A drive download hook listens for changes in the remote registry and streams file changes from the Hyperdrive to the local disk.
Portals are identified by unique* 32-byte keys. When a client 'joins' a portal, portal
looks up the session key using Hyperswarm and establishes a connection to the host using UDP holepunching.
*8.63x10-78 chance of collision
Might seem similar to another similar project built on top of the Hypercore protocol called Dat but there are a few key differences.
portal
focuses purely on being one-to-many for file sharing/syncing.portal
is designed to be zero-config, it doesn't leave any dotfiles laying around, whereas Dat stores secrets and metadata in a ~/.dat
folder.portal
runs on the same underlying protocols, I haven't found a need to utilize version histories yet.portal
respects your .gitignore
so it doesn't sync anything you don't want (like pesky node_modules
)node >= v12.22.1
yarn
to install deps and yarn dev
to enable hot-reloadyarn link
to register portal
as a valid executableFAQs
Zero-config peer-to-peer encrypted live folder syncing that respects your .gitignore
The npm package portal-sync receives a total of 4 weekly downloads. As such, portal-sync popularity was classified as not popular.
We found that portal-sync demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.