
Security News
vlt Launches "reproduce": A New Tool Challenging the Limits of Package Provenance
vlt's new "reproduce" tool verifies npm packages against their source code, outperforming traditional provenance adoption in the JavaScript ecosystem.
General file integrity checker, can check recursively. Support SFV, MD5, ZIP, CBZ, 7Z, GZ, BZ2, LHA, LZH, ARJ, CHM, XZ, RAR, CBR and media file containing CRC32 sum in filename with extension with AVI, MKV, MP4, OGM, ASF, RM, RAM, WEBM. Require 7zip and Unrar for checking archive file. Supports Linux / Mac OS X / Windows.
Example filename: Big Bunny [c001beef].avi
Linux:
Mac OS X:
Windows: (NTFS Only)
All OS: Download and install WinRAR/unrar, copy unrar(.exe) to bin path
This program uses filesystem's extended attributes, if the filesystem doesn't support the extended attribute or isn't enabled, then you can only use the read only function. This also applies to any network drive.
ckfiles [arguments] [directory] <directory2> <directory3>
--recursive -r Recursively check all files
--noop -n Not moving corrupted files
--read-only -x Read Only, do not write attribute (imply -n)
--expiry -e Expiry time since last check, can be in seconds, or m/h/d/w/mo/y
--outfile -o Output error to a file
--help -h Display current help message
FAQs
Unknown package
We found that ckfiles demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
vlt's new "reproduce" tool verifies npm packages against their source code, outperforming traditional provenance adoption in the JavaScript ecosystem.
Research
Security News
Socket researchers uncovered a malicious PyPI package exploiting Deezer’s API to enable coordinated music piracy through API abuse and C2 server control.
Research
The Socket Research Team discovered a malicious npm package, '@ton-wallet/create', stealing cryptocurrency wallet keys from developers and users in the TON ecosystem.