
Research
Malicious npm Packages Impersonate Flashbots SDKs, Targeting Ethereum Wallet Credentials
Four npm packages disguised as cryptographic tools steal developer credentials and send them to attacker-controlled Telegram infrastructure.
@aladas-org/cryptocalc
Advanced tools
Purpose
CryptoCalc is a Cryptocurrency wallet generator provided as a standalone non custodial desktop application.
These wallets can be Non Deterministic (Simple Wallet) or Hierarchical Deterministic (BIP32
).
Even though there is already similar tools online, the purpose is to provide these features
locally on your computer (non custodial) in order to reduce the risk of your Private Key / WIF
or seed phrase informations being stolen.
NB: Since its first release CryptoCalc has been downloaded 8740 times on npm (even though there is also bots involved
in downloads, it seems that there is between 100 and 150 frequent users).
Supported Cryptocurrencies: BTC (Bitcoin), ETH (Ethereum), XRP (Ripple), BNB (Binance Smart Chain), SOL (Solana), DOGE (Dogecoin), TRX (TRON), ADA (Cardano), XLM (Stellar), SUI (Sui), BCH (Bitcoin Cash), AVAX (Avalanche), TON (Toncoin), LTC (Litecoin), ETC (Ethereum Classic), POL (Polygon), VET (VeChain), BSV (Bitcoin SV), DASH (Dash), RVN (Ravencoin), ZEN (Horizen), LUNA (Terra) and FIRO (Firo)
BNB
support is on Binance Smart Chain (in this blockchain BNB
is a BEP-20
token, see reference 5.3.4)LUNA 2.O
(on Terra blockchain) not LUNA Classic
SUI
support was validated with 'Suiet' (Sui wallet), a Chrome extensionSupported Languages: English, French, Spanish, Italian, Czech, Portuguese, Simplified Chinese, Traditional Chinese, Japanese, Korean, Deutsch, Russian, Esperanto, Latin, Greek, Hindi, Gujarati, Bengali.
NB: CryptoCalc uses ElectronJS as well as many modern and popular Desktop applications (e.g. Visual Studio Code)
Setup
Inno Setup
and following the Howto
provided in the _inno_setup
subfolder (Howto build cryptocalc_setup.txt
)C:\Users\$CURRENT_USER\AppData\Local\Programs\Cryptocalc
$DEFAULT_SETUP_FOLDER\resources\app\_output
cmd
D
then type D:
)md tools
then cd tools
)git clone
followed by the .git
URLgit clone https://github.com/ALADAS-org/cryptocalc.git
cd cryptocalc
npm install
Release notes
0.3.49
README.md
)0.3.48
Mouse moves
Entropy source :
XOR
operation) each mouse point
(provided by the user) with a random byte (generated with Crypto.getRandomValues()
)0.3.47
0.3.46
D6 dices
0.3.45
Mouse moves
Entropy source:
0.3.15
to 0.3.45
0.3.44
Mouse moves
0.3.43
D6 dices
(e.g. 100 rolls for 256 bits of Entropy)0.3.42
0.3.41
0.3.40
Marketcap
button (after Explore
button) in Wallet Tab Page to show the relevant coinmarketcap URL0.3.39
Math.random
with a more secure for cryptography usage (see secureRandom()
in hex_utils.js
)0.3.38
POL
cryptocurrency (POL) in Simple Wallet, HD Wallet and SWORD Wallet modesSUI
support was validated0.3.37
SUI
cryptocurrency (Sui) in HD Wallet / SWORD Wallet modes0.3.36
ZEN
(Horizen) in the kist of supported cryptocurrencies0.3.35
ZEN
cryptocurrency (Horizen) in Simple Wallet mode0.3.34
ZEC
(ZCASH) is not supported ATM0.3.33
RVN
cryptocurrency (Ravencoin) in HD Wallet / SWORD Wallet modes0.3.32
LUNA
cryptocurrency (Terra, it's LUNA 2.O
not LUNA Classic
) in Simple Wallet mode0.3.31
BSV
cryptocurrency (Bitcoin SV) in HD Wallet / SWORD Wallet modes0.3.30
VET
cryptocurrency (VeChain) in HD Wallet / SWORD Wallet modes0.3.29
ETC
cryptocurrency (Ethereum Classic) in HD Wallet / SWORD Wallet modes0.3.28
0.3.27
induced by incomplete clean after prototyping TON
support0.3.27
TON
cryptocurrency (Toncoin blockchain) but supported only in Simple Wallet mode0.3.26
BNB
cryptocurrency on Binance Smart Chain Blockchain (see reference 5.3.4)CryptoCalc User Guide
You can launch CryptoCalc either by first installing it with the CryptoCalc Standalone installer (see 2.1)
or by downloading the npm package
(see 2.2) then double clicking on _run.bat
.
$DEFAULT_SETUP_FOLDER\resources\app\_output
: Notice that this folder won't be automatically deleted if you uninstall CryptoCalcBIP39
specification) then in the Shortened seed phrase each mnemonic is represented
only by its 4 first characters (with the first character in Uppercase as a mean to separate mnemonics).NTAG213 NFC
(see 4.2.3).D6 Dices
, Mouse moves
, Image
or Fortunes
D6 Dices
: default source, the number of rolls depends on Entropy size (e.g. 100 rolls for 256 bits)Mouse moves
: entropy bytes are generated when the user moves the mouse pointeImage
:
png
, jpg
or svg
) from you local folders.www/img
folder.www/img/CryptoCurrency
Fortunes
: drawn from a compilation of 12803 Fortune CookiesWallet
tab page)
Derivation Path
used by HD Wallets). So a it's a good fit to
Give it a Try and start creating your Cryptocurrency Wallets with minimum knowledge.Please notice that the
Derivation Path
is nowHardened
by default and mandatory (since0.3.18
). This is for Security purpose (see 5.2.3) TheBIP32
HD wallet tree_ is fully determined by the Entropy (or seed phrase which is equivalent) and an optional Password. The Entropy may be represented by a more human friendly representation: the Mnemonics Sequence which may also be called a seed phrase, Mnemonics or even SRP (Secret Recovery Passphrase).
How to Generate a new wallet with a given Entropy:
Paste a new Entropy (or seed phrase) in theEntropy
wallet tab. Notice that this will hide the Entropy Source and Salt fields (meaningless in this situation).
You can then change either the Account or Address Index fields (the maximum number of digits is 9 so you can input a decimal value between 0 and 999999999 for each field) in the Wallet tab page. This will show a [Refresh] button to recompute the wallet once you have finished. Pushing the [Refresh] button (or hitting either [Return] or [Enter] keys while the cursor is in either Account or Address Index field) will recompute the wallet address (and Private key or WIF) accordingly.
SWORD
is an acronym which means Simple Wallet Over Randomized Deterministic
,
it's an hybrid between Simple Wallet
and HD Wallet
because it hides the Derivation Path
logic
(which contains Account
and Address Index
), thus you don't need to care or understand the principles
of Hierarchical Deterministic wallets, but it allows to generate all the cryptocurrencies provided by HD Wallet
.Cardano
HD wallets, the Account
and Address Index
parameters are not taken
into account by the Wallet Managers which I have tested (namely Guarda
and Yoroi
) because they ask for
the Mnemonics
(Seed phrase
in CryptoCalc). This is why in CryptoCalc, these parameters are hard-coded
to Zero (for Cardano
HD wallets only).Help menu
(Help/Resources/Ian Coleman BIP39
)Refresh
icon, like in the main toolbar).
Important Notice: Once a password is provided, you must use the [Apply] button to recompute the HD hierarchy,
this is the reason why Save is disabled (in the main toolbar and in the 'File' menu) until you click on the [Apply] button.UUID
) to ensure that the Entropy will be different at each Generation even if the Entropy Source
is the same. Thus the Entropy will be unique at each press of [Generate] button.Wallet
tab page. There's also an [Explorer...] button which allows to check
the generated address in the appropriate Blockchain Explorer.Wifi ON
red icon) or not connected (Wifi OFF
green icon)Save
Wallet InformationsFile/Save
(or the Save icon in the main toolbar), you can save the Wallet Informations in a timestamped
subfolder (eg. 2024_10_07_21h-4m-4s-3_BTC_EN
) under _output
folder.
This subfolder contains wallet_info.txt
and a wallet.json
with the informations displayed in Entropy and Wallet tab pages.
png
images) for Address
, Private Key
, Seedphrase
,
Entropy
and WIF
(if applicable).xtras
subfolder where these QR codes are provided
in the svg
format. There is also a Rectangular Micro QR code (rMQR
) of the
Entropy
(Rectangular Micro QR Code, R15x59
or R15x77
version depending on
Entropy size
) and an experimental Ultracode
color QR code of the Entropy
.QRQR
an Android QR Code reader published by Arara on the Google Play Store.Entropy
field of CryptoCalc.Entropy Size
and
Derivation path
(if applicable, don't forget to use the [Refresh] button)
than those used when the wallet was created (these informations
are provided either in the wallet_info.txt
or in wallet_info.wits
).Open
Wallet Informations of a previously saved wallet
.txt
but also as a .wits
file (JSON
format)..wits
file can be opened either with File.Open...
menu item or 'Open...' icon
in the toolbar. It can be also be opened in Cryptocalc.exe
by double clicking on the .wits
(File extension to Application feature): this will launchlc Cryptocalc.exe
(cf. 2.1 for installing
Cryptocalc.exe
with the CryptoCalc Standalone installer) /File.Save As...
which will save the wallet with a different timestamp than the original one.Account
and/or the Address Index
(dont forget to push
the [Refresh] button). Now you can save the new wallet with File.Save As...
and if you didn't change the Entropy
then this new wallet will belong to the same Bip32 HD Wallet Tree
(see 5.2) than the original one.Guarda
Guarda
.BIP39
wordlist (see also 5.1.1).
You can choose to display these indexes in Decimal or Binary
(in Binary you can check that the computed Checksum bits are added at the end
of the converted Entropy to determine the index of the last word).BIP32
hierarchy that is determined by the
seed phrase (also called the Secret Recovery Passphrase).Tools/Options
)Default Blockchain
, Wallet Mode
and Entropy Size
.
These values are defined in www/config/options.json
file.www/config/defaults/options.json
)l10n
) feature is the translation of
GUI Labels to adapt to the locale (eg. en
).
A locale name can be composed of a base language, country (territory) of use,
and optionnally a codeset (eg. de_CH.UTF-8
).
The locale is provided as part of your machine's environment.
CryptoCalc only uses the 2 letter language part (eg. en
).
Localization is enabled by a JSon file in the www/js/L10n
folder
(eg. gui-msg-en.json
) .
Currently only en
and fr
are provided.Guarda
you can import
a wallet generated by CryptoCalc:
BTC
,ETH
,XRP
,ADA
,DOGE
,LTC
,SOL
,AVX
,TRON
,BCH
,DASH
,Firo
BTC
wallets)NTAG213 NFC
with
144 bytes useable capacity. This is enough to store the Shortened Seedphrase,
with a 24 words Shortened Seedphrase
the maximum required capacity is 96 bytes/characters (24*4, cf. 4.1.1)
or even less (as some mnemonics have only three characters).Appendix
BIP39
: a Dictionary of 2048 wordsBIP39
(BIP
is the acronym of Bitcoin Improvement Proposal) is a specification regarding:
BIP32
: Hierarchic Deterministic wallets
BIP32
specifies how to generate wallets with are all derived from the same Entropy
or seed phrase (also called the Secret Recovery Passphrase).
A seed phrase of only 12 words is enough is most Wallet Managers but it is much more secure to use a 24 words
seed phrase if possible (e.g. Ledger hardware wallet manager).m/44'/60'/0'/0/0'
(a Hardened Derivation Path):
Start at the master key (m)
Follow the BIP44
specification (44')
Derive the key for Ethereum (for which Coin type is 60) (60')
Access the first account (0')
Choose the external chain, used for public addresses (0)
And finally, generate the first address in this sequence (0')
FAQs
Cryptocurrency wallet generator
The npm package @aladas-org/cryptocalc receives a total of 89 weekly downloads. As such, @aladas-org/cryptocalc popularity was classified as not popular.
We found that @aladas-org/cryptocalc demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Four npm packages disguised as cryptographic tools steal developer credentials and send them to attacker-controlled Telegram infrastructure.
Security News
Ruby maintainers from Bundler and rbenv teams are building rv to bring Python uv's speed and unified tooling approach to Ruby development.
Security News
Following last week’s supply chain attack, Nx published findings on the GitHub Actions exploit and moved npm publishing to Trusted Publishers.