
Research
Malicious NuGet Packages Typosquat Nethereum to Exfiltrate Wallet Keys
The Socket Threat Research Team uncovered malicious NuGet packages typosquatting the popular Nethereum project to steal wallet keys.
The pr-zlib library is a pure Ruby version of the zlib compression library. It consists of both a port of zlib.h and the Ruby zlib library that ships as part of the standard library.
gem install pr-zlib
gem cert --add <(curl -Ls https://raw.githubusercontent.com/djberg96/pr-zlib/main/certs/djberg96_pub.pem)
# Imitating a bit of code used in rubygems
require 'pr/zlib'
require 'stringio'
data = StringIO.new(data)
Zlib::GzipReader.new(data).read
First, building the zlib C library on MS Windows with Visual C++ is very difficult. However, certain libraries depend on zlib, most notably rubygems. By providing a pure Ruby version we eliminate any compiler or platform compatability issues.
Second, even some Unix distributions, such as Debian, do not ship with the zlib library by default. By creating a pure Ruby version of the zlib library we eliminate the need to install a 3rd party C library, and eliminate a potential weak link in the dependency chain.
Third, by creating pure Ruby versions of the library and the interface we are more likely to receive patches, feature requests, documentation updates, etc, from the Ruby community since not everyone who knows Ruby also knows C.
Last, the zlib interface that ships as part of the stdlib is a little on the clunky side. By providing a pure Ruby version, authors can create their own interface as they see fit.
Update August 2025: Most of the original motivation for this library is no longer relevant today. Desktop users of MS Windows typically use the one-click installer which bundles the shared objects it needs. In the land of Unix, where most actual production code happens, folks use Docker images for Ruby which either already bundles everything, or they just add it to their Dockerfile.
But, hey, I paid for this and it works. Who knows, maybe it'll be nice to have around someday.
This library was the result of a small code bounty that I (Daniel Berger) funded:
https://rubytalk.org/t/bounty-pure-ruby-zlib-gzipwriter/50730
More tests, and better tests, are needed for both Rbzlib and Zlib.
You cannot use both this library and the zlib standard library at the same time. If you try to use both there is a good chance you will get an allocation error of some sort. If you already have zlib, you do not need this library.
This library is covered under the same license as zlib itself. For the text of the zlib license, please see http://zlib.net/zlib_license.html.
FAQs
Unknown package
We found that pr-zlib demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
The Socket Threat Research Team uncovered malicious NuGet packages typosquatting the popular Nethereum project to steal wallet keys.
Product
A single platform for static analysis, secrets detection, container scanning, and CVE checks—built on trusted open source tools, ready to run out of the box.
Product
Socket is launching experimental protection for the Hugging Face ecosystem, scanning for malware and malicious payload injections inside model files to prevent silent AI supply chain attacks.