Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
uzip-module
Advanced tools
zlib inflate, deflate, inflateRaw, deflateRaw, as well as simple in memory zip creation and parsing.
This is a ES6 module version of UZIP.js
It's faster than pako in my tests.
import {
deflate,
deflateRaw,
inflate,
inflateRaw,
encode,
parse,
} from 'uzip-module';
Includes header and footer
const compressed = deflate(uint8Array);
or
const compressed = deflate(uint8Array, {level:9});
const uncompressedUint8Array = inflate(compressedUint8Array);
or
const uncompressedUint8Array = inflate(
compressedUint8Array,
destinationUint8Array);
These take the exact same arguments as inflate
and deflate
but don't store or expect the header or the footer
Creates a zip file. You pass a JavaScript object of filenames to Uint8Arrays it returns a Uint8Array zip file
const utf8Encoder = new TextEncoder();
const files = {
'stuff/': utf8Encoder.encode(''),
'stuff/dog.txt': utf8Encoder.encode('german shepard\n'),
'stuff/birds/': utf8Encoder.encode(''),
'stuff/birds/bird.txt': utf8Encoder.encode('parrot\n'),
'stuff/cat.txt': utf8Encoder.encode('siamese\n'),
'stuff/long.txt': utf8Encoder.encode(`${new Array(200).fill('compress').join('')}\n`),
}
const zipUint8Array = encode(files);
Does the opposite of encode. Takes a zip Uint8Array and returns a JavaScript object of filenames to Uint8Arrays
Calling parse
on the zipUint8Array
from the previous
example will return the same data seen in files
above
const unzippedFiles = parse(files);
You can also call it with an extra true
in which case it will
just return the filenames and a size
and csize
for each one.
The uncompressed and compressed sizes;
const unzippedFileSizes = parse(files, true);
unzippedFileSizes
would have a structure like
{
"stuff/": {
"size": 0,
"csize": 0
},
"stuff/dog.txt": {
"size": 15,
"csize": 15
},
"stuff/long.txt": {
"size": 1601,
"csize": 24
}
}
All credit goes to the original author Photopea.
I ported this to ES6 modules to use in another library.
Originally I thought about putting the various parts in more separate files
like the inflate in one file, deflate in another, parse, and encode in others
but tree shaking is supposed to handle this stuff more or less
so I think just moving it to ES6 modules is enough to get any
unused code stripped. The only other think maybe left to do
is change the bin
and f
imports in UZIP.js
to import each
individual identifier instead of all of them.
Also I spent about an hour trying to get ES6 modules to work with mocha in node but failed so got sick of wasting time and used puppeteer. Patches welcome to remove that dependency.
I didn't make a non-ES6 version. If it's important submit a PR (babel) and I'll take a look.
FAQs
Module version of UZIP.js
We found that uzip-module demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.