Research
Security News
Malicious npm Package Targets Solana Developers and Hijacks Funds
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
github.com/elido/qml
This package is in an alpha stage, and still in heavy development. APIs may change, and things may break.
At this time contributors and developers that are interested in tracking the development closely are encouraged to use it. If you'd prefer a more stable release, please hold on a bit and subscribe to the mailing list for news. It's in a pretty good state, so it shall not take too long.
See this video for a quick introduction.
Please join the mailing list for following relevant development news and discussing project details.
The API documentation is available in the usual location.
To try the alpha release, you'll need:
In practice, if you are in Ubuntu, this should work for the Qt dependencies:
$ sudo add-apt-repository ppa:ubuntu-sdk-team/ppa
$ sudo apt-get update
$ sudo apt-get install ubuntu-sdk qtbase5-private-dev qtdeclarative5-private-dev
and Go 1.2 may be installed using godeb:
$ # Pick the right one for your system: 386 or amd64
$ ARCH=amd64
$ wget -q https://godeb.s3.amazonaws.com/godeb-$ARCH.tar.gz
$ tar xzvf godeb-$ARCH.tar.gz
godeb
$ sudo mv godeb /usr/local/bin
$ godeb list | head -1
1.2rc1
$ godeb install 1.2rc1
If you're not in Ubuntu and your operating system does not offer these dependencies, you may have success installing Go 1.2rc1 and Qt 5.0.2 directly from the upstreams.
Once the requirements above are satisfied, go get should work as usual:
go get github.com/niemeyer/qml
FAQs
Unknown package
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
Security News
Research
Socket researchers have discovered malicious npm packages targeting crypto developers, stealing credentials and wallet data using spyware delivered through typosquats of popular cryptographic libraries.
Security News
Socket's package search now displays weekly downloads for npm packages, helping developers quickly assess popularity and make more informed decisions.