Research
Security News
Malicious npm Package Targets Solana Developers and Hijacks Funds
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
github.com/hashgraph/hedera-sdk-go/v2
The Go SDK for interacting with a Hiero based network. Hiero communicates using gRPC; the Protobufs definitions for the protocol are available in the hashgraph/hedera-protobuf repository (the repo will be migrated to Hiero in near future).
$ go install github.com/hiero-ledger/hiero-sdk-go/v2@latest
[!NOTE]
google.golang.org/protobuf
v1.27.1 Breaks the SDK as it contains multiple protobuf files with the same name. Make sure to use v1.26.1 instead. The follow snippet can be used ingo.mod
to force the project to use v1.26.1
replace (
google.golang.org/protobuf v1.27.1 => google.golang.org/protobuf v1.26.1-0.20210525005349-febffdd88e85
)
$ env CONFIG_FILE="<your_config_file>" go test -v Integration -timeout 9999s
or
$ env CONFIG_FILE="<your_config_file>" OPERATOR_KEY="<key>" OPERATOR_ID="<id>" go test -v Integration -timeout 9999s
or
$ env OPERATOR_KEY="<key>" OPERATOR_ID="<id>" go test -v Integration -timeout 9999s
The config file can contain both the network and the operator, but you can also
use environment variables OPERATOR_KEY
and OPERATOR_ID
. If both are provided
the network is used from the config file, but for the operator the environment variables
take precedence. If the config file is not provided then the network will default to Hedera testnet
and OPERATOR_KEY
and OPERATOR_ID
must be provided.
This repository uses golangci-lint for linting. You can install a pre-commit git hook that runs golangci-lint before each commit by running the following command:
scripts/install-hooks.sh
Whether you’re fixing bugs, enhancing features, or improving documentation, your contributions are important — let’s build something great together!
Please read our contributing guide to see how you can get involved.
Hiero uses the Linux Foundation Decentralised Trust Code of Conduct.
FAQs
Unknown package
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
Security News
Research
Socket researchers have discovered malicious npm packages targeting crypto developers, stealing credentials and wallet data using spyware delivered through typosquats of popular cryptographic libraries.
Security News
Socket's package search now displays weekly downloads for npm packages, helping developers quickly assess popularity and make more informed decisions.