Research
Security News
Malicious npm Package Targets Solana Developers and Hijacks Funds
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
github.com/jmhodges/levigo
levigo is a Go wrapper for LevelDB.
The API has been godoc'ed and is available on the web.
Questions answered at golang-nuts@googlegroups.com
.
You'll need the shared library build of LevelDB installed on your machine. The current LevelDB will build it by default.
The minimum version of LevelDB required is currently 1.7. If you require the use of an older version of LevelDB, see the fork of levigo for LevelDB 1.4. Prefer putting in the work to be up to date as LevelDB moves very quickly.
Now, if you build LevelDB and put the shared library and headers in one of the standard places for your OS, you'll be able to simply run:
go get github.com/jmhodges/levigo
But, suppose you put the shared LevelDB library somewhere weird like /path/to/lib and the headers were installed in /path/to/include. To install levigo remotely, you'll run:
CGO_CFLAGS="-I/path/to/leveldb/include" CGO_LDFLAGS="-L/path/to/leveldb/lib" go get github.com/jmhodges/levigo
and there you go.
In order to build with snappy, you'll have to explicitly add "-lsnappy" to the
CGO_LDFLAGS
. Supposing that both snappy and leveldb are in weird places,
you'll run something like:
CGO_CFLAGS="-I/path/to/leveldb/include -I/path/to/snappy/include"
CGO_LDFLAGS="-L/path/to/leveldb/lib -L/path/to/snappy/lib -lsnappy" go get github.com/jmhodges/levigo
(and make sure the -lsnappy is after the snappy library path!).
Of course, these same rules apply when doing go build
, as well.
Comparators and WriteBatch iterators must be written in C in your own library. This seems like a pain in the ass, but remember that you'll have the LevelDB C API available to your in your client package when you import levigo.
An example of writing your own Comparator can be found in https://github.com/jmhodges/levigo/blob/master/examples.
FAQs
Unknown package
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
Security News
Research
Socket researchers have discovered malicious npm packages targeting crypto developers, stealing credentials and wallet data using spyware delivered through typosquats of popular cryptographic libraries.
Security News
Socket's package search now displays weekly downloads for npm packages, helping developers quickly assess popularity and make more informed decisions.