Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
@anastasia-labs/direct-offer-offchain
Advanced tools
The Direct Offer Offchain project provides a typescript based SDK to convenietly interact with Plutarch-based implementation of a smart contract enabling peer-to-peer trading, in a trustless manner, for the Cardano blockchain. Without the need for a trusted third party or a Decentralized Exchange (DEX), a user can put up any Cardano native asset(s) for sale in exchange for any user-specified native asset(s).
This project is funded by the Cardano Treasury in Catalyst Fund 10
P2P trading in the context of this project refers to the direct buying and selling of Cardano Native Tokens (both Fungible & Non-Fungible Tokens) among users, without a third party or an intermediary. This is unlike buying and selling digital assets using a Centralized Exchange (CEX), where you cannot transact directly with counterparties or a DEX where you trade against a fixed Liquidity Pool.
Trading on a CEX requires you to give custody of your tokens to them, so they can execute the trades you enter based on their charts and market order aggregators. A CEX provides access to their order book and facilitates trades and takes fees in exchange.
Depending on the type of order you use, effects such as slippage may mean you don’t get the exact price you want. P2P trading, on the other hand, gives you full control over pricing, settlement time, and whom you choose to sell to and buy from. What is even better you don't need to give custody of your assets to a centralized entity, they are locked in a contract from which you can reclaim them up until the point they are bought.
This project fulfills the cornerstone requirement of a trusted Escrow, over seeing the trade in the form of a smart contract. It locks the seller's assets in the contract until a buyer provides the required ask price or the seller wishes to cancel the offer and claim the funds back.
npm install @anastasia-labs/direct-offer-offchain
or
pnpm install @anastasia-labs/direct-offer-offchain
// You can get the compiled scripts here: https://github.com/Anastasia-Labs/direct-offer/tree/master/compiled
import spendingValidator from "../directOfferSpending.json" assert { type : "json" };
import stakingValidator from "../directOfferStaking.json" assert { type : "json" };
export const lucid = await Lucid.new(
new Maestro({
network : "Preprod",
apiKey: "your maestro api key",
}),
"Preprod"
);
lucid.selectWalletFromPrivateKey(
"your secret key here e.g. ed25519_...",
);
const offerScripts = {
spending: spendingValidator.cborHex,
staking: stakingValidator.cborHex
};
import {
MakeOfferConfig,
makeOffer
} from "@anastasia-labs/direct-offer-offchain";
const makeOfferConfig: MakeOfferConfig = {
offer: {
["lovelace"]: 10_000_000n
},
toBuy: {
[toUnit("e16c2dc8ae937e8d3790c7fd7168d7b994621ba14ca11415f39fed72",
"4d494e")]: 10_000n,
},
scripts: offerScripts,
};
const makeOfferUnSigned = await makeOffer(lucid, makeOfferConfig);
if (makeOfferUnSigned.type == "ok") {
const makeOfferSigned = await makeOfferUnSigned.data.sign().complete();
const makeOfferHash = await makeOfferSigned.submit();
await lucid.awaitTx(makeOfferHash);
console.log(`Made offer: ${makeOfferHash}`)
}
import {
FetchOfferConfig,
getOfferUTxOs
} from "@anastasia-labs/direct-offer-offchain";
const offerConfig: FetchOfferConfig = {
scripts: offerScripts
};
const offers = await getOfferUTxOs(lucid, offerConfig);
console.log("Available Offers", offers);
import {
AcceptOfferConfig,
acceptOffer
} from "@anastasia-labs/direct-offer-offchain";
const acceptOfferConfig: AcceptOfferConfig = {
offerOutRef: offers[0].outRef,
scripts: offerScripts
};
const acceptOfferUnsigned = await acceptOffer(lucid, acceptOfferConfig);
if (acceptOfferUnsigned.type == "ok"){
const acceptOfferSigned = await acceptOfferUnsigned.data
.sign()
.complete();
const acceptOfferSignedHash = await acceptOfferSigned.submit();
await lucid.awaitTx(acceptOfferSignedHash);
console.log(`Accepted offer: ${acceptOfferSignedHash}`)
}
In the main directory
pnpm run build
https://github.com/vitest-dev/vitest
pnpm test
FAQs
https://docs.github.com/en/packages/quickstart
We found that @anastasia-labs/direct-offer-offchain demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.