
Security News
npm Tooling Bug Incorrectly Marks One-Character Packages as Security Holders
npm confirmed a tooling bug incorrectly marked several one-character packages as security holders and said it was working on a rollback.
lukechampine.com/walrus
Advanced tools
walrus is a Sia wallet server. It presents a low-level, performant API that is
suitable for private, professional, and commercial use. The server itself does not
store seeds or private keys, and therefore cannot sign transactions; these
responsibilities are handled by the client. Accordingly, walrus works well
with Sia-compatible hardware wallets such as the Ledger Nano
S.
API docs for the server are available here.
A client for walrus is available here.
The client facilitates constructing, signing, and broadcasting transactions, and
supports both hot wallets and hardware wallets.
walrus serverIf you plan to expose your walrus API to the public internet, it is highly
recommended that you add HTTPS and HTTP Basic Authentication via a reverse
proxy. Without these security measures, an attacker would still be unable to
access your private keys, but they could potentially trick you into losing
funds. Better safe than sorry.
In addition, if you want to access your wallet via a browser (such as Sia Central's Lite Wallet), you will need to enable CORS. Refer to the following documentation based on your reverse proxy:
FAQs
Unknown package
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
npm confirmed a tooling bug incorrectly marked several one-character packages as security holders and said it was working on a rollback.

Research
/Security News
Newer packages in this compromise use native extensions and .pth loaders to execute JavaScript stealers in developer environments.

Research
Socket found 37 malicious PyPI wheels that abuse Python startup hooks to launch a Bun-powered credential stealer tied to Mini Shai-Hulud/Miasma.