Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Bindings to libzip for handling zipfile archives in node.
var zipfile = require('zipfile');
// Creating a zipfile object
var zf = new zipfile.ZipFile('./test/data/world_merc.zip');
// the zipfile has a list of names:
// zf.names[0] === 'world_merc.prj'
// the zipfile also has a count property that is the number of files contained
// zf.count == 2
// finally it has a readFile method that uncompresses a single file
// into a Buffer object
zf.readFile('world_merc.prj', function(err, buffer) {
if (err) throw err;
console.log(buffer.toString());
});
To handle large zipfiles and avoid the overhead of passing data from C++ to JS use the copyFile
interface:
var zipfile = require('zipfile');
var zf = new zipfile.ZipFile('./test/data/world_merc.zip');
var zip_entry_name = 'world_merc.shp';
var output_file = 'out/world_merc.shp';
zf.copyFile(zip_entry_name,output_file, function(err) {
if (err) throw err;
console.log('Successfully wrote ' + output_file);
});
Install from binary:
npm install
Install from source:
npm install --build-from-source
node-zipfile
depends on libzip, but by default
bundles a copy in deps/ which is statically linked and packaged as a binary.
If you want to use an external libzip first install it:
Debian:
sudo apt-get install libzip-dev libzip1
OS X:
brew install libzip
Then configure node-zipfile with the --shared_libzip option:
npm install --build-from-source --shared_libzip
If you installed libzip in a custom location then configure like:
npm install --build-from-source --shared_libzip \
--shared_libzip_includes=/opt/local/include \
--shared_libzip_libpath=/opt/local/lib
If you installed libzip with homebrew do:
npm install --build-from-source --shared_libzip \
--shared_libzip_includes=`brew --prefix`/include \
--shared_libzip_libpath=`brew --prefix`/lib
BSD, see LICENSE.txt
FAQs
C++ library for handling zipfiles in node
The npm package zipfile receives a total of 1,153 weekly downloads. As such, zipfile popularity was classified as popular.
We found that zipfile demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 14 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.