
Research
Malicious npm Packages Impersonate Flashbots SDKs, Targeting Ethereum Wallet Credentials
Four npm packages disguised as cryptographic tools steal developer credentials and send them to attacker-controlled Telegram infrastructure.
github.com/spensercai/nfc_apdu_runner
NFC APDU Runner is a Flipper Zero application for reading and executing APDU commands on NFC cards. This application allows users to load APDU commands from script files, send them to NFC cards, and view the response results.
nfc_apdu_runner.fap
file to the /ext/apps/NFC/
directory on your Flipper Zeroapdu_script
directory to the /ext/apps_data/nfc_apdu_runner/
directory on your Flipper Zero(If not exist, create it)This project includes additional tools to enhance functionality:
.apdures
files generated by NFC APDU Runner applicationsScript files use the .apduscr
extension with the following format:
Filetype: APDU Script
Version: 1
CardType: iso14443_4a
Data: ["00A4040007A0000002471001", "00B0000000"]
Where:
Filetype
: Fixed as "APDU Script"Version
: Current version is 1CardType
: Card type, can be iso14443_4a, iso14443_4b, iso14443_3a, or iso14443_3bData
: List of APDU commands, each command as a hexadecimal stringExecution results will be saved as files with the .apdures
extension in the following format:
Filetype: APDU Script Response
Response:
In: 00A4040007A0000002471001
Out: 9000
In: 00B0000000
Out: 6A82
/ext/apps_data/nfc_apdu_runner/
directory.apdures
extensionIf you encounter issues:
Filetype: APDU Script
Version: 1
CardType: iso14443_4a
Data: ["00A4040007A0000002471001", "00B0000000"]
This example script will select the application with AID A0000002471001 and then read data.
Filetype: APDU Script
Version: 1
CardType: iso14443_4b
Data: ["00A4040007A0000002471001", "00B0000000"]
This example script will execute the same commands on an ISO14443-4B card.
This project is licensed under the GNU General Public License v3.0 - see the LICENSE file for details.
FAQs
Unknown package
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Four npm packages disguised as cryptographic tools steal developer credentials and send them to attacker-controlled Telegram infrastructure.
Security News
Ruby maintainers from Bundler and rbenv teams are building rv to bring Python uv's speed and unified tooling approach to Ruby development.
Security News
Following last week’s supply chain attack, Nx published findings on the GitHub Actions exploit and moved npm publishing to Trusted Publishers.