Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
svg-captcha
Advanced tools
generate svg captcha in node.js
npm install --save svg-captcha
var svgCaptcha = require('svg-captcha');
var captcha = svgCaptcha.create();
console.log(captcha);
// {data: '<svg.../svg>', text: 'abcd'}
with express
var svgCaptcha = require('svg-captcha');
app.get('/captcha', function (req, res) {
var captcha = svgCaptcha.create();
req.session.captcha = captcha.text;
res.type('svg');
res.status(200).send(captcha.data);
});
svgCaptcha.create(options)
If no option is passed, you will get a random string of four characters and corresponding svg.
size
: 4 // size of random stringignoreChars
: '0o1i' // filter out some characters like 0o1inoise
: 1 // number of noise linescolor
: true // characters will have distinct colors instead of grey, true if background option is setbackground
: '#cc9966' // background color of the svg imageThis function returns an object that has the following property:
data
: string // svg path datatext
: string // captcha textsvgCaptcha.createMathExpr(options)
Similar to create api, you have the above options plus 3 additional:
mathMin
: 1 // the minimum value the math expression can bemathMax
: 9 // the maximum value the math expression can bemathOperator
: + // The operator to use, +
, -
or +-
(for random +
or -
)This function returns an object that has the following property:
data
: string // svg of the math expressiontext
: string // the answer of the math expressionsvgCaptcha.loadFont(url)
Load your own font and override the default font.
url
: string // path to your font
This api is a wrapper around loadFont api of opentype.js.svgCaptcha.options
Gain access to global setting object. It is used for create and createMathExpr api as the default options.
In addition to size, noise, color, and background, you can also set the following property:
width
: number // width of captchaheight
: number // height of captchafontSize
: number // captcha text sizecharPreset
: string // random character presetsvgCaptcha.randomText([size|options])
return a random string.
svgCaptcha(text, options)
return a svg captcha based on text provided.
In pre 1.1.0 version you have to call these two functions,
now you can call create() to save some key strokes ;).
default captcha image:
math expression image with color options:
It does not require any c++ addon.
The result image is smaller than jpeg image.
This has to be a joke. /<text.+>;.+</text>/g.test...
svg captcha uses opentype.js underneath, which means that there is no
'<text>1234</text>'.
You get
'<path fill="#444" d="M104.83 19.74L107.85 19.74L112 33.56L116.13 19.74L119.15 19.74L113.48 36.85...'
instead.
Even though you can write a program that convert svg to png, svg captcha has done its job
—— make captcha recognition harder
FAQs
generate svg captcha in node.js or express.js
The npm package svg-captcha receives a total of 12,065 weekly downloads. As such, svg-captcha popularity was classified as popular.
We found that svg-captcha demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.