
Security News
The Hidden Blast Radius of the Axios Compromise
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.
stream-hasher
Advanced tools
A transform-stream that emits hash-digests of streams or vinyl-file-streams
Works with vinyl-streams in buffer- and stream-mode, optionally renames files.
import fs from 'fs';
import streamHasher from 'stream-hasher';
const hasher = streamHasher({single: true});
hasher.on('digest', function(digest) {
console.log('digest=%s', digest)
});
fs.createReadStream('package.json')
.pipe(hasher)
.resume();
// it's a stream2, so pipe it along or dump it, otherwise it will stuck.
import vinylFs from 'vinyl-fs';
import streamHasher from 'stream-hasher';
const hasher = streamHasher();
hasher.on('digest', function(digest, tag) {
console.log('digest=%s tag=%s', digest, tag)
});
vinylFs.src(['src/**/*.js'], {buffer: false}) // works with 'buffer: true', too
.pipe(hasher)
.pipe(vinylFs.dest('dist'));
Creates a new hasher. Recognized options are:
algorithm (string, default: 'sha1'): the hash-algorithm to be used. See crypto.createHash for available algorithms.digestEncoding (string, default: 'hex'): how the resulting digest is encoded. See Buffer#toString for available encodings. Use 'buffer' to get a bare buffer.digestLength (number): if supplied, the digest length is limited to this length.single (boolean, default: false): If true, create a hasher that transforms a single data-stream. If false, create a hasher to transform a vinyl-file-stream. In latter case, the following additional options are recognized:
tagger (function(file)): a function that generates the tag from the processed vinyl-file. Defaults to a function that returns file.path.optioner (function(file)): a function that generates an object to overwrite options per vinyl-file.rename: (function(basename, digest) or string): a function that takes the original file name (without extension) and the calculated digest and should return a replacement file name. The strings 'postfix' and 'prefix' can be used, too. They expose some standard replacers.renameFile (function (file)): to obtain even finer control of renaming supply a function that takes a vinyl-file and the digest to directly manipulate the file's path.maxSingleSize (number): In the special case of an stream-file to be renamed, the digest must me emitted before the file can be passed forward. Then is value is used to set the highWaterMark for processing that file to prevent deadlocking. Default is 16MB.is emitted for every calculated hash-digest
digest: the calculated digesttag: the file's tagnewTag: if renaming was specified, this is the file's tag after renamingFAQs
A through-stream that calculates hash-digests on the fly
We found that stream-hasher demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.