
Security News
/Research
Wallet-Draining npm Package Impersonates Nodemailer to Hijack Crypto Transactions
Malicious npm package impersonates Nodemailer and drains wallets by hijacking crypto transactions across multiple blockchains.
ubid - Unique Browser ID
====
Attempts to generate a number of unique identifiers for a given browser.
These identifiers are useful for when cookies and/or local storage have been disabled. For instance, Apple has started doing this for all third-party websites shown in iframes. Although that may help privacy to some degree (arguably, not enough of a degree given this module), it can also render parts of sites unusable for legitimate purposes to users.
var ubid = require( 'ubid' );
ubid.get( function( error, signatureData ) {
if ( error ) {
console.error( error );
return;
}
// dump for example
console.log( signatureData );
} );
Would produce:
{
"random": {
"signature": "0d9444a0-c566-4c87-a2c6-406b2e12a26a"
},
"browser": {
"signature": "fe90bcf955cc65b51f1adc1ca374f163e09a29c6d173e25c783c9c5c77badada"
},
"canvas": {
"signature": "db5991b6bb503650bf69b285a6c0f895f11b73c135c112905241f60835be2652"
},
"localStorage":true
}
Let's break them down:
This is a random guid assigned to the browser. This will change each time unless localStorage is true, in which case this is the best identifier to use since it is almost certainly guaranteed to be unique and to persist.
This is also a best case for private browsing modes in that this id will differ from normal browsing (this is normally desirable).
This is a unique id generated by rendering some fonts and colors to an HTML5 canvas and hashing the result. According to various sources (eg: https://www.browserleaks.com/canvas) this can be a fairly reliable unique identifier due to the variances in how different graphics cards and systems will render the results.
This is a unique id generated by joining and hashing a number of browser attributes. This is most likely the least unique identifier and should be the last resort for identifing a particular user/browser.
FAQs
A browser identification library.
The npm package ubid receives a total of 525 weekly downloads. As such, ubid popularity was classified as not popular.
We found that ubid demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
/Research
Malicious npm package impersonates Nodemailer and drains wallets by hijacking crypto transactions across multiple blockchains.
Security News
This episode explores the hard problem of reachability analysis, from static analysis limits to handling dynamic languages and massive dependency trees.
Security News
/Research
Malicious Nx npm versions stole secrets and wallet info using AI CLI tools; Socket’s AI scanner detected the supply chain attack and flagged the malware.