
Research
/Security News
Malicious npm Packages Target WhatsApp Developers with Remote Kill Switch
Two npm packages masquerading as WhatsApp developer libraries include a kill switch that deletes all files if the phone number isn’t whitelisted.
@blooo/hw-app-everscale
Advanced tools
This repository contains JavaScript bindings for interacting with the Everscale Ledger App.
To use this SDK, install it via npm:
npm install @blooo/hw-app-everscale
Everscale API
transport
Transport a transport for sending commands to a devicescrambleKey
a scramble key (optional, default "everscale_default_scramble_key"
)import Everscale from "@blooo/hw-app-everscale";
const Everscale = new Everscale(transport);
Get the application configuration from the device.
const version = await everscale.getAppConfiguration();
console.log(version); // "1.1.0"
Returns Promise<string> A promise that resolves to the application version as a string in the format "major.minor.patch".
Get the Everscale address for a given account number and wallet type.
accountNumber
number The account number to derive the address from.walletType
WalletType The type of wallet to use (e.g., WALLET_V3).display
boolean Whether to display the address on the device for confirmation (default: true). (optional, default true
)const address = await everscale.getAddress(0, WalletType.WALLET_V3, true);
console.log(address); // "0x7571b498e3fed7a0fffbe21377e50548c92da4a04842e1b163547d3e8980cf64"
Returns Promise<string> A promise that resolves to the Everscale address as a hexadecimal string prefixed with "0x".
Get the public key for a given account number.
accountNumber
number The account number to derive the public key from.display
boolean Whether to display the public key on the device for confirmation (default: true). (optional, default true
)const publicKey = await everscale.getPublicKey(0, false);
console.log(publicKey); // "0x3099f14eccaa0542d2d60e92eb66495f6ecf01a114e12f9db8d9cb827a87bf84"
Returns Promise<string> A promise that resolves to the public key as a hexadecimal string prefixed with "0x".
Sign a message with the private key derived from the given account number.
accountNumber
number The account number to derive the signing key from.messageHash
string The hash of the message to sign, as a hexadecimal string with or without "0x" prefix.const signature = await everscale.signMessage(0, "1111111111111111111111111111111111111111111111111111111111111111");
console.log(signature); // "0x40d4883fb9095f3610dfc0888917c8b5548c7074f0f010966c94a5c405ccabe8d320c90334786dbf2b34f10e75c5370ae151b0b11cb190a16d7509983964d6dd00"
Returns Promise<string> A promise that resolves to the signature as a hexadecimal string prefixed with "0x".
Sign a transaction with the device.
inputData
string The payload to sign, as a hexadecimal string with or without "0x" prefix.
The data is composed of:
- Account number (4 bytes): The account number to retrieve
- Wallet Type (1 byte): To derive address
- Decimals (1 byte): Token decimals
- Ticker length (1 byte): Length of the ticker string
- Ticker (variable): Token ticker
- Metadata (1 byte): Flags for optional fields
- Current wallet number (1 byte, optional): To parse transaction ABI (if metadata & 0x01)
- Workchain ID (1 byte, optional): Network workchain (if metadata & 0x02)
- Deploy contract address (32 bytes, optional): Contract address (if metadata & 0x04)
- Chain ID (4 bytes, optional): Network chain ID (if metadata & 0x08)
- Serialized transaction (variable): The transaction dataconst inputData = "0000000001090455534454000101040100C9002161B3BADB535D1B88D0E4D60D316567B1448568EFAFDF21846ECD0BA02E3ADABF97000000CA7E2C951FB3D692B2A677323640012165801BE2256B3D704F24C46AEA3298C1A5EA8F8D1AA86CCC89474BC0570265E7898AC0000000000000000036D36956F8B969D03802216B562548AD00000000000000000000000049504F808015E4256B3D704F24C46AEA3298C1A5EA8F8D1AA86CCC89474BC0570265E7898AD00328480101C03BF4894E22CDD500E450CBE5838B9938FDA1E4D3727FE3B5385C5114B0293F0001";
const signature = await everscale.signTransaction(inputData);
console.log(signature); // "0xa8b3ee327f6a64945e875d59ec49b12bea553b30170be65c541176f052156035428f8a0180e9f8802622b4f3339f2161076790b822e55c0d46f01b919f6de005"
Returns Promise<string> A promise that resolves to the signature as a hexadecimal string prefixed with "0x".
FAQs
Ledger Hardware Wallet Everscale Application API
The npm package @blooo/hw-app-everscale receives a total of 0 weekly downloads. As such, @blooo/hw-app-everscale popularity was classified as not popular.
We found that @blooo/hw-app-everscale demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
Two npm packages masquerading as WhatsApp developer libraries include a kill switch that deletes all files if the phone number isn’t whitelisted.
Research
/Security News
Socket uncovered 11 malicious Go packages using obfuscated loaders to fetch and execute second-stage payloads via C2 domains.
Security News
TC39 advances 11 JavaScript proposals, with two moving to Stage 4, bringing better math, binary APIs, and more features one step closer to the ECMAScript spec.