Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
@aries-framework/bbs-signatures
Advanced tools
Aries Framework JavaScript BBS Module provides an optional addon to Aries Framework JavaScript to use BBS signatures in W3C VC exchange.
yarn add @aries-framework/bbs-signatures
When using AFJ inside the React Native environment, temporarily, a dependency for creating keys, signing and verifying, with bbs keys must be swapped. Inside your package.json
the following must be added. This is only needed for React Native environments
+ "resolutions": {
+ "@mattrglobal/bbs-signatures": "@animo-id/react-native-bbs-signatures@^0.1.0",
+ },
"dependencies": {
...
+ "@animo-id/react-native-bbs-signatures": "^0.1.0",
}
+ "overrides": {
+ "@mattrglobal/bbs-signatures": "@animo-id/react-native-bbs-signatures@^0.1.0",
+ },
"dependencies": {
...
+ "@animo-id/react-native-bbs-signatures": "^0.1.0",
}
The resolution field says that any instance of @mattrglobal/bbs-signatures
in any child dependency must be swapped with @animo-id/react-native-bbs-signatures
.
The added dependency is required for autolinking and should be the same as the one used in the resolution.
React Native Bbs Signature has some quirks with setting it up correctly. If any errors occur while using this library, please refer to their README for the installation guide.
node-bbs-signatures
Right now some platforms will see an "error" when installing the @aries-framework/bbs-signatures
package. This is because the BBS signatures library that we use under the hood is built for Linux x86 and MacOS x86 (and not Windows and MacOS arm). This means that it will show that it could not download the binary. This is not an error for developers, the library that fails is node-bbs-signatures
and is an optional dependency for performance improvements. It will fallback to a (slower) wasm build.
0.4.2 (2023-10-05)
FAQs
<h1 align="c
The npm package @aries-framework/bbs-signatures receives a total of 61 weekly downloads. As such, @aries-framework/bbs-signatures popularity was classified as not popular.
We found that @aries-framework/bbs-signatures demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 3 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.