
Research
Security News
Malicious PyPI Package Exploits Deezer API for Coordinated Music Piracy
Socket researchers uncovered a malicious PyPI package exploiting Deezer’s API to enable coordinated music piracy through API abuse and C2 server control.
Tortick (from Russian то́ртик, a diminutive for торт, "cake") is a Telegram-like channel for the Dark Web. It creates a Tor Hidden Service with JSON-speaking API, which allows to create text/flavoured posts and publish binaries (images, music, etc.). All posts and binaries are signed with Hidden Service Ed25519 key, which allows to verify authorship.
For now it works only with Unix-like systems (tested with Debian 12). Other systems support is planned for future releases.
NOTE: This is a pre-alpha. Server is working, but client is in progress of development. So, it does not look as beautiful as it can be.
apt install tor obfs4proxy
Create a channel database:
tortick channel-new --name 'Test Channel' --info '{"author": "Anonymous Person", "email": "author@service.org"}' --db test_channel.db
Add a new post:
tortick post-new --db test_channel.db --text "Hi everyone! I've created my own tortick!" [--postpone ${NOT_NOW}]
Run the server. Also, you can specify Tor bridges:
tortick channel-run --db test_channel.db --bridges working_bridges.txt
Or, you can run your channel locally, at localhost:8000
:
tortick channel-run --db test_channel.db --test
Get the full list of commands:
tortick --help
Last API version: v0 (under development)
/api/v0/info
: Get channel public info/api/v0/updates/{timestamp}
: Get Entity IDs (EntID) of all entities that were published (or edited) starting from {timestamp}
. Returns 100 EntIDs at most. It is recommended to start getting updates from /api/v0/updates/0
./api/v0/entity/{entid}
: Get Entity with specified {entid}
. It can be Post, or Binary summary. Returns error if EntID does not exist./api/v0/binary/{entid}/{fragnum}
: Get fragment with number {fragnum}
(started from 1) of the Binary with specified {entid}
. Returns empty bytes in cause of any error.If you find the project interesting and want to participate, feel free to report bugs and request features here.
FAQs
A Telegram-like channel API for the Dark Web
We found that tortick demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket researchers uncovered a malicious PyPI package exploiting Deezer’s API to enable coordinated music piracy through API abuse and C2 server control.
Research
The Socket Research Team discovered a malicious npm package, '@ton-wallet/create', stealing cryptocurrency wallet keys from developers and users in the TON ecosystem.
Security News
Newly introduced telemetry in devenv 1.4 sparked a backlash over privacy concerns, leading to the removal of its AI-powered feature after strong community pushback.