Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
suffix-thumb
Advanced tools
discover the minimal rules for mapping two sets of words to one another, according to changes in their suffix.
It was built for learning rules about verb conjugations, but in a way, it is just a generic compression algorithm.
The assumption is that a word's suffix is the most-often changed part of a word.
import { learn, convert } from 'suffix-thumb'
let pairs = [
['walk', 'walked'],
['talk', 'talked'],
['go', 'went'],
]
let model = learn(pairs)
/* {
rules: { k: [ [ 'alk', 'alked' ] ] },
exceptions: { go: 'went' },
}*/
let out = convert('walk', model)
// 'walked'
you can pass-in options:
let opts={
threshold:80, //how sloppy our initial rules can be
min:0, //rule must satisfy # of pairs
reverse:true, //compute backward transformation, too
}
let model = learn(pairs, opts)
the model also works transforming the words the other way:
import { learn, reverse, convert } from 'suffix-thumb'
let pairs = [
['walk', 'walked'],
['talk', 'talked'],
['go', 'went'],
]
let model = learn(pairs)
let rev = reverse(model)
let out = convert('walked', rev)
// 'walk'
by default, the model ensures all two-way transformation - if you only require 1-way, you can do:
learn(pairs, {reverse: false})
you can expect the model to be 5% smaller or so - not much.
by default, the model is small, but remains human-readable (and human-editable). We can compress it further, turning it into a snowball inscrutible characters:
import { learn, compress, uncompress, convert } from 'suffix-thumb'
let pairs = [
['walk', 'walked'],
['talk', 'talked'],
['go', 'went'],
]
let model = learn(pairs)
// shrink it
model = compress(shrink)
// {rules:'LSKs3H2-LNL.S3DH'}
// pop it back
model = uncompress(model)
let out = convert('walk', model)
// 'walked'
The models must be uncompressed before they are used, or reversed.
sometimes you can accidentally send in an impossible set of transformations. This library quietly ignores duplicates, by default.
You can use {verbose:true}
to log warnings about this, or validate your input manually:
import { validate } from 'suffix-thumb'
let pairs = [
['left', 'right'],
['left', 'right-two'],
['ok', 'right'],
]
pairs = validate(pairs) //remove dupes (on both sides)
If you are just doing one-way transformation, and not reverse, you may want to allow duplicates on the right side:
let pairs = [
['left', 'right'],
['ok', 'right'],
]
let model = learn(pairs, {reverse: false})
let out = convert('ok', model)
// 'right'
For each word-pair, it generates all n-suffixes of the left-side, and n-suffixes of the right-side.
any good correlations between the two suffix pairs begins to pop out. Exceptions to these rules are remembered. It then exhaustively reduces any redundancies in these rules.
There are some compromises, magic-numbers, and opinionated decisions - in-order to allow productive, but imperfect rules.
The library drops case-information - and numbers and some characters1 will not compress properly.
There may be wordlists with few helpful patterns. Conjugation datasets in English and French tend to get ~85% filesize compression.
MIT
FAQs
learn transformations between two sets of words
We found that suffix-thumb demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.