Research
Security News
Malicious npm Package Targets Solana Developers and Hijacks Funds
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
github.com/keegancsmith/rpc
This is a fork of the stdlib net/rpc which
is frozen. It adds support for context.Context
on the client and server,
including propagating cancellation.
The API is exactly the same, except Client.Call
takes a context.Context
,
and Server methods are expected to take a context.Context
as the first
argument. Additionally the wire protocol is unchanged, so is backwards
compatible with net/rpc
clients.
DialHTTPPathTimeout
function is also added. A future release of rpc may
update all Dial functions to instead take a context.
ClientTrace
functionality is also added. This is for hooking into the rpc
client to enable tracing.
There are many alternatives for RPC in Go, the most popular being
GRPC. However, net/rpc
has the following nice
properties:
The nice API is subjective. However, the API is small, simple and composable.
which makes it quite powerful. IDL tools are things like GRPC requiring protoc
to generate go code from the protobuf files. net/rpc
has no third party
dependencies nor code generation step, simplify the use of it. A benchmark
done on the 6 Sep
2016
indicated net/rpc
was 4x faster than GRPC. This is an outdated benchmark,
but is an indication at the surprisingly good performance net/rpc
provides.
For more discussion on the pros and cons of net/rpc
see the issue proposal:
freeze net/rpc.
Last forked from commit 292a771 on 16 June 2020.
Cancellation implemented via the rpc call _goRPC_.Cancel
.
FAQs
Unknown package
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
Security News
Research
Socket researchers have discovered malicious npm packages targeting crypto developers, stealing credentials and wallet data using spyware delivered through typosquats of popular cryptographic libraries.
Security News
Socket's package search now displays weekly downloads for npm packages, helping developers quickly assess popularity and make more informed decisions.