
Research
/Security News
DuckDB npm Account Compromised in Continuing Supply Chain Attack
Ongoing npm supply chain attack spreads to DuckDB: multiple packages compromised with the same wallet-drainer malware.
@actual-app/crdt
Advanced tools
@actual-app/crdt
This package contains the core CRDT logic that enables Actual’s syncing. It is shared between the client and server. We may or may not follow semver when updating this package; any usage of it outside Actual is undocumented and at your own risk.
We use protobuf to encode messages as binary data to send across the network.
The protobuf is generated by using the protoc compiler.
This can be installed by downloading one of the pre-built binaries and placing it in your $PATH
. The version used to build the current protobuf is v3.20.1. You’ll also need to download the latest version of protoc-gen-js
. For convenience, you can put both of these binaries in ./bin
.
Once installed, the protobuf can be generated by running ./bin/generate-proto
.
However there is one very important thing to remember! The default output includes this near the top:
var global = (function() { return this || window || global || self || Function('return this')(); }).call(null);
This will not work with our CSP directives. You must manually modify this to this:
var global = globalThis;
FAQs
CRDT layer of Actual
The npm package @actual-app/crdt receives a total of 3,204 weekly downloads. As such, @actual-app/crdt popularity was classified as popular.
We found that @actual-app/crdt demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
Ongoing npm supply chain attack spreads to DuckDB: multiple packages compromised with the same wallet-drainer malware.
Security News
The MCP Steering Committee has launched the official MCP Registry in preview, a central hub for discovering and publishing MCP servers.
Product
Socket’s new Pull Request Stories give security teams clear visibility into dependency risks and outcomes across scanned pull requests.