
Research
Malicious fezbox npm Package Steals Browser Passwords from Cookies via Innovative QR Code Steganographic Technique
A malicious package uses a QR code as steganography in an innovative technique.
Early in Node.js I wrote an HTTP client library called request
. It evolved
along with Node.js and eventually became very widely depended upon.
A lot has changed since 2010 and I've decided to re-think what a simple HTTP client library should look like.
This new library, r2
, is a completely new approach from request
.
r2
is built on top of the browser's
Fetch API and shimmed for Node.js.const r2 = require('r2')
let html = await r2('https://www.google.com').text
Simple JSON support.
let obj = {ok: true}
let resp = await r2.put('http://localhost/test.json', {json: obj}).json
Simple headers support.
let headers = {'x-test': 'ok'}
let res = await r2('http://localhost/test', {headers}).response
Being written to the Fetch API is a huge benefit for browser users.
When running through browserify request
is ~2M uncompressed and ~500K compressed. r2
is only 66K uncompressed and 16K compressed.
FAQs
HTTP client. Spiritual successor to request.
We found that r2 demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
A malicious package uses a QR code as steganography in an innovative technique.
Research
/Security News
Socket identified 80 fake candidates targeting engineering roles, including suspected North Korean operators, exposing the new reality of hiring as a security function.
Application Security
/Research
/Security News
Socket detected multiple compromised CrowdStrike npm packages, continuing the "Shai-Hulud" supply chain attack that has now impacted nearly 500 packages.