Research
Security News
Malicious npm Package Targets Solana Developers and Hijacks Funds
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
github.com/arduino/uno-r4-wifi-fwuploader-plugin
The uno-r4-wifi-fwuploader-plugin
is a core component of the arduino-fwuploader. The purpose of this plugin is to abstract all the
business logic needed to update firmware and certificates for the uno r4 wifi board.
Contributions are welcome!
:sparkles: Thanks to all our contributors! :sparkles:
When running only the plugin without the fwuploader, the required tools are downloaded by the fwuploader. If you run only the plugin, you must provide them by hand.
Therefore be sure to place the espflash
and bossac
binaries in the correct folders like the following:
.
├── bossac
│ └── 1.9.1-arduino5
│ └── bossac
├── espflash
│ └── 2.0.0
│ └── espflash
└── uno-r4-wifi-fwuploader-plugin_linux_amd64
└── bin
└── uno-r4-wifi-fwuploader-plugin
Commands
uno-r4-wifi-fwuploader-plugin cert flash -p /dev/ttyACM0 ./certificate/testdata/portenta.pem
uno-r4-wifi-fwuploader-plugin firmware get-version -p /dev/ttyACM0
uno-r4-wifi-fwuploader-plugin firmware flash -p /dev/ttyACM0 ~/Documents/fw0.2.0.bin
UnknownModel
On some arm64 Linux distros, version 2.0.0 of espflash might panic with the following error:
Error: × Main thread panicked.
├─▶ at espflash/src/interface.rs:70:33
╰─▶ called `Result::unwrap()` on an `Err` value: UnknownModel
help: set the `RUST_BACKTRACE=1` environment variable to display a
backtrace.
On Linux, the uno r4 must be plugged into a hub usb to make the flash process work. Otherwise, it won’t be able to reboot in download mode.
$ arduino-fwuploader firmware flash -b arduino:renesas_uno:unor4wifi -a /dev/ttyACM0 -v --log-level debug
Done in 0.001 seconds
Write 46588 bytes to flash (12 pages)
[==============================] 100% (12/12 pages)
Done in 3.106 seconds
Waiting to flash the binary...
time=2023-07-18T14:50:10.492+02:00 level=INFO msg="getting firmware version"
time=2023-07-18T14:50:10.509+02:00 level=INFO msg="firmware version is > 0.1.0 using sketch"
time=2023-07-18T14:50:10.511+02:00 level=INFO msg="check if serial port has changed"
[2023-07-18T12:50:20Z INFO ] 🚀 A new version of espflash is available: v2.0.1
[2023-07-18T12:50:20Z INFO ] Serial port: '/dev/ttyACM0'
[2023-07-18T12:50:20Z INFO ] Connecting...
[2023-07-18T12:50:20Z INFO ] Unable to connect, retrying with extra delay...
[2023-07-18T12:50:21Z INFO ] Unable to connect, retrying with default delay...
[2023-07-18T12:50:21Z INFO ] Unable to connect, retrying with extra delay...
[2023-07-18T12:50:21Z INFO ] Unable to connect, retrying with default delay...
[2023-07-18T12:50:21Z INFO ] Unable to connect, retrying with extra delay...
[2023-07-18T12:50:21Z INFO ] Unable to connect, retrying with default delay...
[2023-07-18T12:50:21Z INFO ] Unable to connect, retrying with extra delay...
Error: espflash::connection_failed
× Error while connecting to device
╰─▶ Failed to connect to the device
help: Ensure that the device is connected and the reset and boot pins are
not being held down
Error: exit status 1
ERRO[0021] couldn't update firmware: exit status 3
INFO[0021] Waiting 1 second before retrying...
INFO[0022] Uploading firmware (try 2 of 9)
time=2023-07-18T14:50:22.229+02:00 level=INFO msg=upload_command_sketch
time=2023-07-18T14:50:22.230+02:00 level=INFO msg="sending serial reset"
Error: reboot mode: upload commands sketch: setting DTR to OFF
...
The whole certificate chain is needed to make it work. Using -u
flags (ex: -u www.arduino.cc:443
) won’t work because it
only downloads the root certificates. The solution is to use only the -f
flag and provide a pem certificate containing the whole chain.
espflash
is a threatThe binary is not signed #348, and some antiviruses might complain. If still doubtful, https://github.com/esp-rs/espflash is open source, and it's possible to double-check the md5 hashes of the binary and the source code. For more information, you can follow this forum thread.
If you think you found a vulnerability or other security-related bug in the uno-r4-wifi-fwuploader-plugin, please read our [security policy] and report the bug to our Security Team 🛡️ Thank you!
e-mail contact: security@arduino.cc
uno-r4-wifi-fwuploader-plugin is licensed under the AGPL 3.0 license.
You can be released from the requirements of the above license by purchasing a commercial license. Buying such a license is mandatory if you want to modify or otherwise use the software for commercial activities involving the Arduino software without disclosing the source code of your own applications. To purchase a commercial license, send an email to license@arduino.cc
FAQs
Unknown package
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
Security News
Research
Socket researchers have discovered malicious npm packages targeting crypto developers, stealing credentials and wallet data using spyware delivered through typosquats of popular cryptographic libraries.
Security News
Socket's package search now displays weekly downloads for npm packages, helping developers quickly assess popularity and make more informed decisions.