Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
github.com/0xsequence/bundler
This project is in the early stages of development and is not yet ready for production use.
Feature | Status |
---|---|
P2P Sharing of operations | ✅ Implemented |
Mempool limits (global and per-dependency) | ✅ Implemented |
Endorser reputation tracking | 🔄 Partial |
Untrusted env support (see 5189) | 🔄 Partial |
Simulation settings | ❌ Not implemented |
Archival generation and broadcast | ✅ Implemented |
Metrics | ✅ Implemented |
Debug methods fallback to Anvil | ✅ Implemented |
Embedded sender | 🔄 Partial |
ERC20 Token fees support | 🔄 Partial |
Receipt Fetching | ❌ Not implemented |
The project is a mempool transaction bundler for general purpose "operations". The project uses ERC-5189 as the reference standard for how the operations are defined and how they should be handled. The project includes a built-in sender, but it is designed to be used with a separate sender (or block builder).
Create a copy of the /etc/bundler-node.conf.sample
file and name it /etc/bundler-1.conf
.
(Optional) Generate a random 12-word mnemonic and put it in the mnemonic
field in the /etc/bundler-1.conf
file.
Define the number of senders to run num_senders
in the /etc/bundler-1.conf
file.
Run with make run
.
The API can be consumed using the client that can be found in the /proto/client
directory. Note that the API is not yet stable and is subject to change.
FAQs
Unknown package
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.