Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
webvr-polyfill-dpdb
Advanced tools
This is a fork of the online cache of the Device Parameter Database (DPDB) for the webvr-polyfill.
You'll need to update dpdb-formatted.json
with your device's information in the following format:
{
"devices": [
{
"type": "android",
"rules": [
{
"mdmh": "asus/*/ASUS_Z00AD/*"
},
{
"ua": "ASUS_Z00AD"
}
],
"dpi": [
403,
404.6
],
"bw": 3,
"ac": 1000
}
]
}
type
: Either "android"
or "ios"
.rules
: An array of various rules that must be satisfied in order to use the configuration. See the Rules section below.dpi
: The DPI of the device's screen, either as a scalar value or as an array of X and Y DPI. Get this information via the Device Info App and look for Actual DPI X
and Actual DPI Y
values.bw
: The bezel width in millimeters, with many phones having between 3 or 4mm bezel widths. See the Calculating Bezel Width section below.ac
: The accuracy of this entry. This is not currently used in webvr-polyfill, but may in the future, and used to settle discrepencies between device reported information versus DPDB data, although this is more for Android apps that have may potentially have access to both API reporting and DPDB results. Can be one of the following values:
0
: measurements are speculative. Use as fallback only.500
: measurements are based on the device's self-reported values, which is often inaccurate. Unless you're physically measuring a device, this is probably the value to use.1000
: measurements are based on measuring a physical device.The rules
entry is an array of objects, each with one key/value pair, and matches if any of the rules match the device.
The ua
rule is matched with the device's User-Agent string. It is not a regular expression, but just a simple substring match. Go to useragentstring.com and find something unique that looks like the device's name. Use this if device type is "android"
. Keep in mind of other models, where a string for the Nexus 5 could match the Nexus 5X, hence a string like "Nexus 5 "
(note the extra space).
{ "ua": "ASUS_Z00AD" }
The mdmh
rule matches a device based on manufacturer, device, model, and hardware, as reported by the device's Android API. This rule is only applicable to Android devices running native apps, not the web.
{ "mdmh": "asus/*/ASUS_Z00AD/*" }
The res
rule matches a device based on its exact pixel resolution. This should normally only be used on iOS devices because there's a 1:1 mapping between exact resolution and phone model.
{ "res": [640, 960] }
You can calculate the exact bezel width using this formula, where deviceWidth
is in millimeters, screen
is the screen's diagonal length in millimeters, and ratio
is the screen resolution's width / height
:
(deviceWidth - Math.sqrt((screen * screen) / (1 + (1 / (ratio * ratio))))) / 2;
To generate the dpdb.json
file from the dpdb-formatted.json
source file, run this npm script from the command line:
npm run build
Or call this Node script directly:
node scripts/build.js --write
The following devices were added (and/or corrections made):
FAQs
A Device Parameter Database for the WebVR Polyfill
The npm package webvr-polyfill-dpdb receives a total of 16,672 weekly downloads. As such, webvr-polyfill-dpdb popularity was classified as popular.
We found that webvr-polyfill-dpdb demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 3 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.