{"id":16129685,"url":"https://github.com/duddu/cordova-plugin-antitampering","last_synced_at":"2025-03-16T09:32:16.599Z","repository":{"id":14289084,"uuid":"76251100","full_name":"duddu/cordova-plugin-antitampering","owner":"duddu","description":"Verify the integrity of cordova static assets - Android / iOS","archived":false,"fork":false,"pushed_at":"2022-12-30T18:18:05.000Z","size":399,"stargazers_count":22,"open_issues_count":20,"forks_count":23,"subscribers_count":3,"default_branch":"develop","last_synced_at":"2025-03-06T02:44:51.811Z","etag":null,"topics":["anti-tampering","cordova","security"],"latest_commit_sha":null,"homepage":null,"language":"JavaScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/duddu.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2016-12-12T11:38:49.000Z","updated_at":"2023-12-13T06:42:49.000Z","dependencies_parsed_at":"2022-08-07T11:15:10.566Z","dependency_job_id":null,"html_url":"https://github.com/duddu/cordova-plugin-antitampering","commit_stats":null,"previous_names":[],"tags_count":13,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/duddu%2Fcordova-plugin-antitampering","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/duddu%2Fcordova-plugin-antitampering/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/duddu%2Fcordova-plugin-antitampering/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/duddu%2Fcordova-plugin-antitampering/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/duddu","download_url":"https://codeload.github.com/duddu/cordova-plugin-antitampering/tar.gz/refs/heads/develop","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":243809844,"owners_count":20351406,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["anti-tampering","cordova","security"],"created_at":"2024-10-09T22:11:58.669Z","updated_at":"2025-03-16T09:32:16.222Z","avatar_url":"https://github.com/duddu.png","language":"JavaScript","funding_links":[],"categories":[],"sub_categories":[],"readme":"Anti-Tampering Cordova Plugin\n=============================\n\n[![npm](https://img.shields.io/npm/v/cordova-plugin-antitampering.svg)](https://www.npmjs.com/package/cordova-plugin-antitampering)\n[![Travis branch](https://img.shields.io/travis/duddu/cordova-plugin-antitampering/master.svg)](https://travis-ci.org/duddu/cordova-plugin-antitampering)\n[![Codacy Badge](https://api.codacy.com/project/badge/Grade/596be7addc734ba9979e66713d237052)](https://www.codacy.com/app/duddu/cordova-plugin-antitampering?utm_source=github.com\u0026amp;utm_medium=referral\u0026amp;utm_content=duddu/cordova-plugin-antitampering\u0026amp;utm_campaign=Badge_Grade)\n\nThis plugin verifies the **integrity of the static assets** of your Cordova application, checking if the files have changed since the original build.  \nBefore the compile phase, it creates a hash (SHA-256) for each file found under the `www` directory of your platforms; then, every time the app is launched, it compares those hashes with ones created at run-time from the actual assets loaded.  \nThe plugin also provides optional **debug detection**, to prevent your App from running in debug mode.  \n\nSupports Android and iOS.\n\n## Installation\n\nInstall latest release from npm:\n\n    cordova plugin add cordova-plugin-antitampering\n\nInstall latest commit from branch develop:\n\n    cordova plugin add https://github.com/duddu/cordova-plugin-antitampering#develop\n\n## Usage\n\n### Default behaviour\n\nBy default (since v0.1.0), if a tampering is detected on one of the assets **the plugin will make the app crash**, as a mean of defense, in order to stop the alleged attacker from keep playing.  \nThis behaviour is achieved\n- on Android: throwing a `SecurityException` that immediately terminates the app\n- on iOS: causing a `BAD ACCESS` that brings the app to crash (welcome to any better idea)\n\nIf you don't want this to happen, or you need to have more control over the check result, keep reading.\n\n### Call the plugin from JavaScript\n\nYou can disable the standard behaviour, and run the anti-tampering check manually from JavaScript, in order to get the result of the check from cordova callbacks. Obviously, this is less secure than the default behaviour, since it keeps the app running after tampering detected (I do not recommend it in production).  \nTo run the check from JavaScript, install the plugin with the `ENABLE_CORDOVA_CALLBACK` preference (aka variable):\n\n    cordova plugin add cordova-plugin-antitampering --variable ENABLE_CORDOVA_CALLBACK=true --save\n\nIf you set the variable to `false` (or any other value than `true`), the plugin will keep the standard behaviour.  \nBy setting this variable to `true`, you tell the plugin to skip the automatic check on app launch, and so you are free to do it whenever you want from JavaScript.  \nFor this purpose, the plugin exports a method which you can call like this:\n\n    window.cordova.plugins.AntiTampering.verify(\n        function (success) {\n            console.info(success);\n            // {\"assets\": {\"count\": x}} - where x is the number of assets checked\n        },\n        function (error) {\n            console.error(error);\n            // gives you the file on which tampering was detected\n        }\n    );\n\nIf you are using **AngularJS** (eg with Ionic), you can use the angular service `$antitampering` provided with the plugin; it has a `verify` method that returns a promise. Remember to require the plugin's module `duddu.antitampering` first:\n\n    var app = angular.module('myApproximatelySecureApp', ['duddu.antitampering']);\n\n    app.run(['$antitampering', function ($antitampering) {\n        $antitampering.verify().then(function (success) {\n            console.info(success);\n        }, function (error) {\n            console.error(error);\n        });\n    }]);\n\n### Exclude assets by extensions\n\nBy default (since v0.2.0), the integrity check run against all the assets found. You can choose to manually exclude some of your assets, providing their extension with the `EXCLUDE_ASSETS_EXTENSIONS` variable while installing the plugin. E.g. to exclude all the fonts assets:\n\n    cordova plugin add cordova-plugin-antitampering --variable EXCLUDE_ASSETS_EXTENSIONS=\"ttf, eot, svg, woff, woff2\" --save\n\nThe value of this variable should be a list of extensions, separated by comma or space. \n\n### Debug Detection\n\nOptional debug detection can be enabled using the `ENABLE_DEBUG_DETECTION` variable (default `false`) while installing the plugin:\n\n    cordova plugin add cordova-plugin-antitampering --variable ENABLE_DEBUG_DETECTION=true --save\n\nIf enabled (i.e. for release builds in production), the plugin also verifies - before any other check - that the app is not running in debug mode / doesn't have a debugger attached. As for the assets integrity check, if this check fails the app will crash (or return an error message on javascript callback, if `ENABLE_CORDOVA_CALLBACK=true`). \n\n## Additional info\n\n- The plugin recursively searches for files within the `www` directory of each platform (i.e. cordova assets); no other directory is considered.\n- The files hashes (against which the assets are validated) are created at `before_compile`. I chose this hook since there are several plugins which changes the content (or hierarchy) of the assets during the `prepare` phase, and the integrity check must be run on the final version of the assets.\n- As a consequence of the previous point, the check is effective only when you compile your project using the command `cordova build` (or `prepare`+`compile`), not for the `run` command.\n\n## Security warning\n\nThis plugin can't be considered as an exhaustive integrity check for your app: an app can always be tampered somehow. Remember to protect any sensitive logic, obfuscate your Java source for Android, prevent your app to be debuggable, and consider to encrypt your static assets.\n\n## Todo\n\n- Add a check for the version, versionCode, and package name of the app\n- Add a check for the signing certificate\n- Add support for server-side integrity validation\n\n## Contributing\n\nAny suggestions, remarks, or pull requests are welcome!\n\nIf you want to contribute: fork the repo, create a new branch, and submit a PR *to the develop branch* of this repo. I will merge into develop, and then into master on the next release tag.\n\nThe plugin is tested (thanks to Travis CI) on **Cordova versions from 5 to 9**, on both Android and iOS platforms.","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fduddu%2Fcordova-plugin-antitampering","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fduddu%2Fcordova-plugin-antitampering","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fduddu%2Fcordova-plugin-antitampering/lists"}