Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
***WARNING***: This library is a client for an API that is currently in private testing. Using it will break in all sorts of ways. There are bugs. There will be changes. Do not use this unless you know what you're doing.
WARNING: This library is a client for an API that is currently in private testing. Using it will break in all sorts of ways. There are bugs. There will be changes. Do not use this unless you know what you're doing.
YOU HAVE BEEN WARNED
Ok, so, on to the useful bits.
This library provides a client for the W3C API, which exposes information about things such as specifications, groups, users, etc. It follows a simple pattern in which one builds up a query, and then causes the data to be fetched.
The usual:
npm install w3capi
This documentation does not describe the fields that the various objects have; refer to the W3C API's documentation for that.
Everything always starts in the same way:
var w3c = require("w3c");
This gives you a client instance that's immediately ready to work. You then chain some methods to specify what you want to get, and fetch with a callback. For example:
var w3c = require("w3capi")
, handler = function (err, data) {
if (err) return console.error("[ERROR]", err);
console.log(data);
}
;
just list all the groups
w3c.groups()
.fetch(handler)
;
get the editors for a specific version of a specification
w3c.specification("SVG11")
.version("20030114")
.editors
.fetch(handler)
;
If you are familiar with the W3C API you know that it supports paging. This library hides that fact and when it sees a paged list of results it always fetches the whole set. Typically that is a very reasonable number of items.
fetch([options], cb)
All queries end with a call to fetch()
. You can pass { embed: true }
as an option if you with
for the returned value to embed some of the content from the API (this matches ?embed=true
). At
this point that is the only option. You can do without the options
altogether.
The cb
receives the typical err
and data
parameters.
Usage summary:
w3c.specifications().fetch()
w3c.specification("SVG").fetch()
w3c.specification("SVG").versions().fetch()
w3c.specification("SVG").version("19991203").fetch()
w3c.specification("SVG").version("19991203").deliverers().fetch()
w3c.specification("SVG").version("19991203").editors().fetch()
You can list all specifications, or get a single one using its shortname. For a given specification, you can list its versions and for a given version its editors and deliverers (the groups who shipped it).
In the W3C API, versions also have next
and previous
links but there is an open issue about the
way in which they are implemented and so they are not exposed here.
Usage summary:
w3c.groups().fetch()
w3c.group(54381).fetch()
w3c.group(54381).chairs().fetch()
w3c.group(54381).services().fetch()
w3c.group(54381).specifications().fetch()
w3c.group(54381).teamcontacts().fetch()
w3c.group(54381).users().fetch()
w3c.group(54381).charters().fetch()
w3c.group(46884).charter(89).fetch()
You can list all groups or get a specific one by its ID (this is the same ID used in IPP, if you're familiar with that — also the same used in ReSpec for the group). There are several sublists that can be obtained, that are hopefully self-explanatory. The charters can be listed, and a specific charter can be fetched given its ID (an opaque number).
Usage summary:
w3c.user("ivpki36ou94oo08osswccs80gcwogwk").fetch()
w3c.user("ivpki36ou94oo08osswccs80gcwogwk").affiliations().fetch()
w3c.user("ivpki36ou94oo08osswccs80gcwogwk").groups().fetch()
w3c.user("ivpki36ou94oo08osswccs80gcwogwk").specifications().fetch()
Users cannot be listed, and the ID used to fetch them is an opaque identifier (not the ID used internally in the system so as to make it harder to slurp them all in). Various sublists can be obtained.
Usage summary:
w3c.domains().fetch()
w3c.domain(41481).fetch()
w3c.domain(41481).groups().fetch()
w3c.domain(41481).activities().fetch()
w3c.domain(41481).services().fetch()
w3c.domain(41481).users().fetch()
Domains are an organisational structure internal to the W3C, of little interest to the outside world except to note that the Interaction Domain is the best.
Usage summary:
w3c.services(2).fetch()
w3c.services(2).groups().fetch()
Services model tools that groups (or domains) can use, such as IRC, a bug tracker, a mailing list, etc. At this point in time, the services database isn't well-maintained but it could become more useful in future.
FAQs
Deprecated — use package “node-w3capi” instead
The npm package w3capi receives a total of 0 weekly downloads. As such, w3capi popularity was classified as not popular.
We found that w3capi demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 3 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.