
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
Index filesystem by creating metadata database
Go trough the files under a given directory, generate a hash of each of the files (which by default is SHA1), and store the hashes to a SQLite database (which by default is in memory). In case the given file was already listed in the database, its entry will be updated.
Please note that the minimum supported version of Node.js is 22.11.0, which is the active Long Term Support (LTS) version.
The name of the project (Tozan, 当山) is for honouring the legacy of a certain master from the Ryukyu archipelago, Japan, who contributed to the martial arts that we today know as karate and ryukyu kobujutsu.
Read more about why these martial arts are important for me at karatejukka.fi.
Install via npm, as a global command line utility:
[sudo] npm install --global tozan
Please note that while in Linux and with sudo, some of the dependencies might fail to install,
which can be fixed in some case by sudo npm install --global --unsafe-perm tozan.
See more details about the unsafe-perm option at docs.npmjs.com.
The SHA hash is calculated with OpenSSL, specifically with its openssl dgst command, hence it needs to be available in the PATH.
The existence of OpenSSL can be checked with the command openssl version, which should output something similar to (example in macOS):
LibreSSL 2.8.3
In case the installed OpenSSL does not support the default hashing algorithm (SHA-256),
the hash algorithm need to be defined via command line options.
The supported digest algorithms can be seen with the command openssl list -digest-algorithms.
Easiest way to see the supported options, is to execute with help output:
tozan --help
The most recent major version has the similar output to the following:
tozan [options] <directory>
-h, --help Help and usage instructions
-V, --version Version number
-D, --database String SQLite database to use - default: :memory:
-H, --hash String Hashing algorithm understood by OpenSSL - default: sha1
-i, --ignore-dot-files Ignore files and directories that begin with a dot
Version 6.0.0
For more information on the possible database file options, see sqlite3 documentation for the filename parameter.
First install as a dependency:
npm install --save tozan
Use in a Node.js script:
import tozan from 'tozan';
tozan('directory-for-scanning', {
ignoreDotFiles: true, // Ignore files and directories that begin with a dot
algorithm: 'sha512' // Hash algorithm to use
database: 'tozan-meta.sqlite' // Possible database file to be used with SQLite
});
Clearest example of the usage is in the command line interface.
These numbers are from running time node bin/tozan.js --hash [algorithm] node_modules with different algorithms.
At the time the node_modules folder contained total of 11410 files.
| Algorithm | Time |
|---|---|
md4 | 1m 11.409s |
md5 | 1m 16.059s |
sha1 | 1m 13.361s |
sha256 | 1m 12.263s |
sha384 | 1m 15.404s |
sha512 | 1m 11.746s |
streebog512 | 1m 11.888s |
whirlpool | 1m 8.089s |
Looks like the differences are not that big. Feel free to add and update the comparison with more data and more alternatives.
First thing to do is to file an issue. Then possibly open a Pull Request for solving the given issue. ESLint is used for linting the code, please use it by doing:
npm install
npm run lint
Unit tests are written with tape and can be executed with npm test.
Code coverage is inspected with nyc and
can be executed with npm run coverage after running npm test.
Please make sure it is over 90% at all times.
Licensed under the MIT license.
Copyright (c) Juga Paazmaya paazmaya@yahoo.com
FAQs
Index filesystem by creating metadata database
We found that tozan demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.