
Research
/Security News
Intercom’s npm Package Compromised in Ongoing Mini Shai-Hulud Worm Attack
Compromised intercom-client@7.0.4 npm package is tied to the ongoing Mini Shai-Hulud worm attack targeting developer and CI/CD secrets.
ut_metadata
Advanced tools
JavaScript implementation of the Extension for Peers to Send Metadata Files (BEP 9). Use with bittorrent-protocol.
The purpose of this extension is to allow clients to join a swarm and complete a download without the need of downloading a .torrent file first. This extension instead allows clients to download the metadata from peers. It makes it possible to support magnet links, a link on a web page only containing enough information to join the swarm (the info hash).
Works in the browser with browserify! This module is used by WebTorrent.
npm install ut_metadata
This package should be used with bittorrent-protocol, which supports a plugin-like system for extending the protocol with additional functionality.
Say you're already using bittorrent-protocol. Your code might look something like this:
import Protocol from 'bittorrent-protocol'
import net from 'net'
net.createServer(socket => {
var wire = new Protocol()
socket.pipe(wire).pipe(socket)
// handle handshake
wire.on('handshake', (infoHash, peerId) => {
wire.handshake(new Buffer('my info hash'), new Buffer('my peer id'))
})
}).listen(6881)
To add support for BEP 9, simply modify your code like this:
import Protocol from 'bittorrent-protocol'
import net from 'net'
import ut_metadata from 'ut_metadata'
net.createServer(socket => {
const wire = new Protocol()
socket.pipe(wire).pipe(socket)
// initialize the extension
wire.use(ut_metadata())
// all `ut_metadata` functionality can now be accessed at wire.ut_metadata
// ask the peer to send us metadata
wire.ut_metadata.fetch()
// 'metadata' event will fire when the metadata arrives and is verified to be correct!
wire.ut_metadata.on('metadata', metadata => {
// got metadata!
// Note: the event will not fire if the peer does not support ut_metadata, if they
// don't have metadata yet either, if they repeatedly send invalid data, or if they
// simply don't respond.
})
// optionally, listen to the 'warning' event if you want to know that metadata is
// probably not going to arrive for one of the above reasons.
wire.ut_metadata.on('warning', err => {
console.log(err.message)
})
// handle handshake
wire.on('handshake', (infoHash, peerId) => {
wire.handshake(new Buffer('my info hash'), new Buffer('my peer id'))
})
}).listen(6881)
ut_metadata([metadata])Initialize the extension. If you have the torrent metadata (Buffer), pass it into the
ut_metadata constructor so it's made available to the peer.
const metadata = fs.readFileSync(__dirname + '/file.torrent')
wire.use(ut_metadata(metadata))
ut_metadata.fetch()Ask the peer to send metadata.
ut_metadata.cancel()Stop asking the peer to send metadata.
ut_metadata.setMetadata(metadata)Set the metadata. If you didn't have the metadata at the time ut_metadata was
initialized, but you end up getting it from another peer (or somewhere else), you should
call setMetadata so the metadata will be available to the peer.
ut_metadata.on('metadata', function (metadata) {})Fired when metadata is available and verified to be correct. Called with a single parameter of type Buffer.
wire.ut_metadata.on('metadata', metadata => {
console.log(Buffer.isBuffer(metadata)) // true
})
Note: the event will not fire if the peer does not support ut_metadata, if they don't have metadata yet either, if they repeatedly send invalid data, or if they simply don't respond.
ut_metadata.on('warning', function (err) {})Fired if:
wire.ut_metadata.on('warning', err => {
console.log(err.message)
})
MIT. Copyright (c) Feross Aboukhadijeh and WebTorrent, LLC.
FAQs
Extension for Peers to Send Metadata Files (BEP 9)
The npm package ut_metadata receives a total of 12,136 weekly downloads. As such, ut_metadata popularity was classified as popular.
We found that ut_metadata demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 9 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Compromised intercom-client@7.0.4 npm package is tied to the ongoing Mini Shai-Hulud worm attack targeting developer and CI/CD secrets.

Research
Socket detected a malicious supply chain attack on PyPI package lightning versions 2.6.2 and 2.6.3, which execute credential-stealing malware on import.

Research
A brand-squatted TanStack npm package used postinstall scripts to steal .env files and exfiltrate developer secrets to an attacker-controlled endpoint.