
Research
Security News
The Landscape of Malicious Open Source Packages: 2025 Mid‑Year Threat Report
A look at the top trends in how threat actors are weaponizing open source packages to deliver malware and persist across the software supply chain.
gitlab.com/pulsechaincom/compressed-allocations
Utilities for generating the PulseChain allocations file.
NOT FINAL NUMBERS
This data has already been exported and is included in data/raw.csv
Converts data/raw.csv into a simplified ACCOUNT,CREDIT_BASE16,CREDIT_BASE10
formatted file. This file can be reviewed by the community.
yarn && yarn convert --project=pulsechain
because pulsechain relies on pulsex data it is necessary to run that project first. this is encapsulated in an easy to use npm script
yarn run convert-all
a few optional flags can be passed to run non default projects through the pipeline such as a folder name (project) and a start time in iso format.
yarn convert --project=pulsex --start-time=2021-12-29T03:30:00Z
pass help to see all options
yarn run convert --help
Small utility to compress the ACCOUNT,CREDIT_BASE16,CREDIT_BASE10
file produced in Step 2 into a minimized binary format.
go run ./src-go/compress
The output data/credits.bin file is what will be embedded in the Go-Pulse binary
A sample implementation of reading and parsing the minimized binary format produced in Step 2 that can be used to audit and verify the compressed binary data.
go run ./src-go/decompress
This allows for easy and direct review of the data in the binary credits file:
# example output
Reading 63 bytes from compressed file './data/credits.bin'
Addr: 0xceb59257450820132ab274ed61c49e5fd96e8868 | Credit: 0x33b2e3c9fd0803ce8000000 (1000000000.000000 PLS)
Addr: 0x731a5796c12638872ebe3f73e25576169ad9d87a | Credit: 0x3635c9adc5dea00000 (1000.000000 PLS)
the defaults for the args are setup for pulsechain, so simply run
yarn run convert --project=pulsex
to get other projects, one should adjust the project flag and any other optional flags to make sure the start time and curve is appropriate
yarn run convert --project=pulsex --start-time=2021-12-29T03:30:00Z --volume-cutoff=53 --flat-cutoff=58 --price-increase-day=12
mined_timestamp
- timestamp when the block was minedtransaction_hash
- transaction hash that the sacrifice is pulled fromcredit_address_id
- an incrementing nonce for the frontend to be able to tie utxo networks back to an evm addressis_sens
- flag to distinguish sens from non-sens donations to reduce the points from sensnetwork
- network that the sacrifice was performed onblock_id
- block height that the sacrifice was mined incurrency
- currency identifier, often in the format of network-hash
ticker
- currency ticker for presentational purposesdecimals
- number of decimals in the currencysource
- source of the price, either from a dex, or cex, or coingecko, or derived from a salecredit_address
- evm address to attribute pointsadvertised_for
- currency was advertised for on pulse.infoignore
- currency has been flagged as untrustworthy and will not be given points with this flagamount
- the value of the transfer as an intusd_price
- usd price of the token twap'd where data providedcredits.bin
- the compressed credits file to be used by the nodecredits.csv
- the credits file, ordered by public addresscredits.csv.example
- the example credits.csv
filepoint-events.csv
- a csv to show the points and how they are summed from their partsraw-advertised-for.csv
- shows the transactions that fall under the advertised for category (must be included)raw-ignored.csv
- transactions that will be ignored because they are scam tokens or otherraw-not-ignored.csv
- transactions that are being considered to be included in the final countraw-reduced.csv
- a reduced version of raw.csv
where only one row per transaction is used - the highest trustworthiness price sourceraw.csv
- the raw transactions joined against price sources - often there will be duplicate rows in this csv because there are multiple price sourcesFAQs
Unknown package
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A look at the top trends in how threat actors are weaponizing open source packages to deliver malware and persist across the software supply chain.
Security News
ESLint now supports HTML linting with 48 new rules, expanding its language plugin system to cover more of the modern web development stack.
Security News
CISA is discontinuing official RSS support for KEV and cybersecurity alerts, shifting updates to email and social media, disrupting automation workflows.