Research
Security News
Threat Actor Exposes Playbook for Exploiting npm to Build Blockchain-Powered Botnets
A threat actor's playbook for exploiting the npm ecosystem was exposed on the dark web, detailing how to build a blockchain-powered botnet.
@appliedblockchain/mantle
Advanced tools
Mantle is a blockchain SDK targeting Ethereum and Hyperledger Fabric
Mantle SDK repository
Initialising a new Mantle instance:
const mantle = new Mantle()
The mantle instance exposes methods to facilitate, amongst other things, mnemonic and HD public/private key generation, IPFS API access etc.
Configuring Mantle
Mantle accepts a configuration object on instantiation, as below:
const mantle = new Mantle({
provider: 'http://localhost:8545', // parity address
proxyURL: 'http://localhost:3000/api', // proxy address for IPFS/Trx calls
contracts: [ {
name: 'foo',
address: '0xde0B295669a9FD93d5F28D9Ec85E40f4cb697BAe',
abi: [ {
type: 'function',
name: 'foo',
constant: false,
payable: false,
stateMutability: 'nonpayable',
inputs: [ { 'name': 'b', 'type': 'uint256' }, { 'name': 'c', 'type': 'bytes32' } ],
outputs: [ { 'name': '', 'type': 'address' } ]
} ]
} ] // contract interfaces - automatically instantiated onto web3 if provided
tokens: {
ERC20: [
{ name: 'TokenName', address: '0x...'} // Will use the default ERC20 abi present in mantle, but a custom abi can be passed here as well
]
},
})
Mnemonic generation
Mnemonic, HD private/public keys and private/public keys are generated via loadMnemonic
. Supply a mnemonic associated with an existing account in order to retrieve key information, or supply no argument in order to generate a new set of keys.
Symmetric encryption
Facilitated via the encryptSymmetric
and decryptSymmetric
static methods. Shared secrets can be generated via createSymmetricKey
.
Please see tests in test/mantle.spec.js
for further examples.
Mnemonic generation and key removal
mantle.mnemonic // undefined
mantle.loadMnemonic() // No argument supplied - used for new accounts
mantle.mnemonic // 'knife zone arch average surround tape napkin elephant share fuel jeans false'
mantle.removeKeys()
mantle.mnemonic // null
mantle.loadMnemonic('tragic panic toast hazard royal marine visual laptop salmon guard finger upper') // Mnemonc supplied - should be used to load existing keys
Asymmetric encryption/decryption
const data = 'foo'
const encrypted = Mantle.encrypt(data, mantle.publicKey) // Returns a buffer
const decrypted = Mantle.decrypt(encrypted, mantle.privateKey) || mantle.decrypt(encrypted) // 'foo'
Symmetric encryption/decryption
const data = 'foo'
const secret = Mantle.createSymmetricKey()
const encrypted = Mantle.encryptSymmetric(data, secret) // Returns a Buffer
const decrypted = Mantle.decryptSymmetric(encrypted, secret) // 'foo'
Tokens
If your config define one or multiple tokens they will be loaded automatically. The first token will become the defaultToken accessible via mantle.defaultToken
. Other tokens can be access via mantle.tokens.TokenName
.
Each tokens also has two convenience methods: getBalance(address)
with address defaulting to mantle.address and sendTokens(address, amount)
. The default token getBalance and sendTokens methods are also aliased directly to mantle.getBalance()
and mantle.sendTokens(...)
.
FAQs
Mantle is a blockchain SDK targeting Ethereum and Hyperledger Fabric
The npm package @appliedblockchain/mantle receives a total of 0 weekly downloads. As such, @appliedblockchain/mantle popularity was classified as not popular.
We found that @appliedblockchain/mantle demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 20 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A threat actor's playbook for exploiting the npm ecosystem was exposed on the dark web, detailing how to build a blockchain-powered botnet.
Security News
NVD’s backlog surpasses 20,000 CVEs as analysis slows and NIST announces new system updates to address ongoing delays.
Security News
Research
A malicious npm package disguised as a WhatsApp client is exploiting authentication flows with a remote kill switch to exfiltrate data and destroy files.