
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
Rotty is a tool to discover bit-rot in files-at-rest. It works similar to the "scrub" functionality in ZFS and BTRFS filesystems. It verifies file data against previously stored checksums.
Silent data corruption is pretty common. However, various error correction mechanisms inside storage drives are able to correct it. Sadly, they only kick in when data is retrieved. There is no periodic or continous proactive data checking. Sometimes the data correction mechanism is not even able to fix the data.
This application is supposed to be run periodically. All it does is reading the files and calculating SHA1 hash of the contents. Technically it would be sufficient to just read the files as reading would trigger potential hardware errors.
This application only checks for file corruption. It is not able to repair the files. You need actual backups to replace the corrupted files!
Modified files based on file modification timestamp are skipped.
This tool is suitable for small dataset of couple of TB in size. The verification operation is assumed to run completely at once and is not resumable. There is no rate-limiting built-in. The dataset size is limited by acceptable running time and the underlying hardware bandwidth.
You need to have Node.js version 18+ installed. To install rotty:
npm install -g rotty
Initialize the checksums file for the directory:
rotty <directory> --init
The configuration file is stored in <directory>/.checksums/config.json. The file
contains:
{
"skip": ["some-file.txt"],
"skipDotfiles": true
}
skip: array of skipped filenames to match in directories.skipDotfiles: whether to skip filenames starting with dot (.).Running rotty <directory> will run verification against files that are in the latest
database and will add new files into the database.
All modified files (based on modification time) will be reported. Files that are not modified but have different checksum will also be reported.
If there are non-modified files with different checksum than previously then the program will exit with status code 1.
The checksums data is stored in <directory>/.checksums directory. The application
creates file checksums-<timestamp>.json containing checksums as a JSON array.
Example database:
[
{
"path": "hello.txt",
"sha1": "da39a3ee5e6b4b0d3255bfef95601890afd80709",
"mtimeMs": 1688067363987.008
}
]
The MIT License. See the LICENSE file.
FAQs
Discovers bit-rot in files
We found that rotty demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.