
Research
PyPI Package Disguised as Instagram Growth Tool Harvests User Credentials
A deceptive PyPI package posing as an Instagram growth tool collects user credentials and sends them to third-party bot services.
shared-access-signature
Advanced tools
This package provides a simple API for generating a Shared Access Signature for use with Microsoft Azure services.
This package allows you to easily generate a Shared Access Signature for use in REST API calls to Microsoft Azure services. Currently the package generates signatures that are suitable for use with Azure Service Bus (includng Event Hubs).
If you are working with Azure you might be wondering why this package exists given that there are already some Node.js packages. My reasoning is that I was working with some smaller embedded platforms which didn't support some of the packages that Microsoft's own package relied on, so this way I can have tighter control of the dependencies and a very simple package.
Using the package is easy. Just download and install it via NPM.
npm install shared-access-signature
Once the package is downloaded and installed you can call it by requiring in the shared-access-signature
package and calling the generateServiceBusSignature(url, sharedAccessKeyName, sharedAccessKey, expirty)
method.
var sas = require('shared-access-signature');
var url = 'https://namespace.servicebus.windows.net/hubname/publishers/devicename/messages';
var sharedAccessKeyName = 'sample-key';
var sharedAccessKey = 'S4lxDeOkdGFgi7xbIVdBakWpxDaPitKsGFUPFxZKT14=';
var currentDate = new Date();
var expiry = currentDate.getTime() / 1000 + 3600; // We require expiry time in seconds since epoch.
var sas = require('shared-access-signature');
var signature = sas.generateServiceBusSignature(url, sharedAccessKeyName, sharedAccessKey, expiry);
console.log(signature);
The expiry parameter can also take a Date object which is helpful, I recommend checking out the awesome momentjs library to deal with dates and quickly generate Date objects projected into the future.
...
var moment = require('moment');
var expiry = moment().add(1, 'day').toDate();
var signature = sas.generateServiceBusSignature(url, sharedAccessKeyName, sharedAccessKey, expiry);
If you find any bugs or would like to see a feature fork the code and submit a pull request, otherwise raise and issue.
FAQs
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
A deceptive PyPI package posing as an Instagram growth tool collects user credentials and sends them to third-party bot services.
Product
Socket now supports pylock.toml, enabling secure, reproducible Python builds with advanced scanning and full alignment with PEP 751's new standard.
Security News
Research
Socket uncovered two npm packages that register hidden HTTP endpoints to delete all files on command.